Nextcloud disclosed a bug submitted by christophwurst: https://hackerone.com/reports/1789602 [Source]