Nextcloud disclosed a bug submitted by meinereiner: https://hackerone.com/reports/1825679 – Bounty: $150 [Source]