Nextcloud disclosed a bug submitted by andyscherzinger: https://hackerone.com/reports/1596459 [Source]