GHCR _catalog returns ALL packages

It looks like the _catalog endpoint of the Docker v2 API has recently been enabled. Trying to use it, I found that it returns every available package from any user/org, rather than just returning the ones associated with the authenticated user.
I’m not sure if this on purpose or a bug, but it’s definitely a different behaviour from other container registries.