Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders.
- https://hackerone.com/reports/508493
No PoCs found on GitHub currently.