Nextcloud disclosed a bug submitted by bjoernv: https://hackerone.com/reports/1606961 – Bounty: $100 [Source]