Nextcloud disclosed a bug submitted by lauritz: https://hackerone.com/reports/1687410 – Bounty: $100 [Source]