Nextcloud disclosed a bug submitted by ctulhu: https://hackerone.com/reports/1781751 – Bounty: $100 [Source]