Nextcloud disclosed a bug submitted by mikaelgundersen: https://hackerone.com/reports/1878381 [Source]