GMS-2022-5607: Team scope authorization bypass when Post/Put request with :team_name in body, allows HTTP parameter pollution

For some Post/Put Concourse endpoint containing :team_name in the URL, a Concourse user can send a request with body including :team_name=team2 to bypass team scope check to gain access to certain resources belong to any other team. The user only needs a valid user session and belongs to team2.