Team object exposes amount of participants in a private program to non-invited users

Similar to other reports, suddenly after the update with ordering users, the GraphQL API is exposing the amount of participants in a private program to non-invited users. This allows an attacker to retrieve the amount of participants in a private program, as well as their details.

query {
    team(handle: "█████") {
     participants { total_count  }
     about

}
}