Nextcloud disclosed a bug submitted by rullzer: https://hackerone.com/reports/2021684 – Bounty: $250 [Source]