User with basic access is able to access Team Staff and Team Detail page of any investment by tampering the URL