Nextcloud disclosed a bug submitted by shakierbellows: https://hackerone.com/reports/1331728 – Bounty: $825 [Source]