Summary
Different Teams can see all other Mattermost members via “Add new members to team” link. Even worse they can even add other teams members as regular user.
Steps to reproduce
Mattermost 5.8.
Create 2 different teams.
Create a few testaccounts on said teams.
Login with one Testuser.
Click Add members to team.
ALL Users are visible as non privileged user.
ALL User can be invited as non privileged user.
Expected behavior
Teams are meant to seperate Accounts.
A regular User should not have the privilege to see all other server members nor to invite them.
Observed behavior
ALL Users are visible as non privileged user.
ALL User can be invited as non privileged user.