Nextcloud disclosed a bug submitted by mikaelgundersen: https://hackerone.com/reports/1258448 [Source]