Conduit feed.publish API allows you to spoof other users or make it look like you have access to a restricted object

The Conduit feed.publish API allows a user to publish stories to the feed. The API accepts a parameter "type" which will be set to `PhabricatorTokenGivenFeedStory` and accepts JSON in the "data" parameter such as the following:

{
  "authorPHID": "PHID-USER-uyg3nn764yetx6nglnbx",
  "tokenPHID": "PHID-TOKN-medal-4",
  "objectPHID": "PHID-TASK-lg22pqfkf4iuqbmx35k4"
}