Nextcloud disclosed a bug submitted by lukasreschke: https://hackerone.com/reports/1720043 – Bounty: $750 [Source]