Nextcloud disclosed a bug submitted by mikeisastar: https://hackerone.com/reports/1668028 – Bounty: $750 [Source]