Nextcloud disclosed on HackerOne: Default Nextcloud Server and...

On a clean Nextcloud setup the functionality "Search global and public address book for users" is enabled. Now when searching for a sharee to share with. The lookup parameter is not passed to the server. Resulting in https://github.com/nextcloud/server/blob/master/apps/files_sharing/lib/Controller…