Nextcloud disclosed a bug submitted by rullzer: https://hackerone.com/reports/1994324 – Bounty: $100 [Source]