A receiver of a federated share with access to the database with ownCloud version before 10.8 could update the permissions and therefore elevate their own permissions.
Published September 7, 2021.
Owncloud Owncloud