Calendar invitation autocomplete ignores global "shareapi" and privacy restrictions

Steps to reproduce

Go to Administration settings -> Sharing.
Under "Limit sharing based on groups", select "Allow some groups" and restrict it to a specific group (e.g., "admin").
Under "Privacy settings for sharing", enable "Allow autocompletion to full match when entering the full name...".
Ensure that only "Also allow autocompletion on full match of the user email" is checked, while other full-match options (like User ID or Display name) are disabled.
Log in as a normal user who is NOT part of the allowed "admin" group.
Open the Calendar app, create a new event, and type single characters or letters into the "Attendees" search field.

Expected behavior

The autocomplete should NOT show any users or email addresses, because sharing is restricted to admins, and incomplete matches are forbidden. This works perfectly in the Files app.

Actual behavior

The Calendar search field completely ignores these administrative restrictions. It queries the global user database and exposes full names and email addresses to unauthorized users immediately upon typing single characters.

Calendar app version

6.5.3

CalDAV-clients used

No response

Browser

Firefox 153.0.3

Client operating system

Windows 11

Server operating system

No response

Web server

None

Database engine version

None

PHP engine version

None

Nextcloud version

34.0.2

Updated from an older installed version or fresh install

None

List of activated apps

Nextcloud configuration

Web server error log

Log file

Browser log

Additional info

No response

Start by reproducing the Calendar Attendees autocomplete with the stated sharing and privacy restrictions, then compare its behavior with the Files app, which correctly enforces them. Trace the Calendar autocomplete entry point and its user search request. Done means unauthorized users receive no names or email addresses when incomplete matching is disabled.