A missing access check in Nextcloud Server prior to 14.0.0 could lead to continued access to password protected link shares when the owner had changed the password.
- https://hackerone.com/reports/146133
No PoCs found on GitHub currently.