MM-63590 - validate user has proper permission when updating team privacy (#30650)

Co-authored-by: Mattermost Build <build@mattermost.com>

server/channels/api4/team.go

@@ -382,6 +382,11 @@ func updateTeamPrivacy(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if !c.App.SessionHasPermissionToTeam(*c.AppContext.Session(), c.Params.TeamId, model.PermissionInviteUser) {
+		c.SetPermissionError(model.PermissionInviteUser)
+		return
+	}
+
 	if err := c.App.UpdateTeamPrivacy(c.Params.TeamId, privacy, openInvite); err != nil {
 		c.Err = err
 		return