Nextcloud disclosed a bug submitted by lukasreschke: https://hackerone.com/reports/1850407 – Bounty: $150 [Source]