Nextcloud disclosed a bug submitted by obitorasu: https://hackerone.com/reports/1702864 – Bounty: $250 [Source]