User can restrict other user's rights unintentionally

We encountered a situation that a user can take away rights from another user in a group folder unjustly just by sharing contents back with lower rights.

Steps to reproduce

1. "Office" group has a group folder named "Shared Externally". Each member of "Office" group can Write, Share, Delete in this group folder.
2. This group folder has subfolders. Each subfolder is shared from a "office" group service user with another (different) user group. For this example we call the other group "Committee A".
3. The group "Committee A" have received the share with right to write and delete, but not to share further on.
4. One person from the "Office" group is a member of both, "Office" and "Committee A" group. (So s/he sees the group folder in its original hierarchy and additionally also on root level as a received share).
5. For a public event, this office person wants to share one document from the "Committee A" subfolder with an open link.
6. The share seems to be created without problems. But when anyone from outside uses the link, Nextcloud says that the document was not found. When an office person who is not group member of "Committee A" creates the link, it is available.

Expected behaviour

Group folder rights should be regarded higher than rights that come with share-receiving.
A user that is member of a group with full rights for a group folder should keep the rights, even if someone shares content of a subfolder again.

Actual behaviour

The office group user as mentioned in 1. loses rights, just because someone shared the same content back with lower rights.

Server configuration

Nextcloud version:
Nextcloud Hub II (23.0.4) with all updates

Group folders version:
11.1.2

Are you using external storage, if yes which one:
No

Are you using encryption: yes/no
No

Client configuration

Browser:
Any

Start by reproducing the permission conflict with the six sharing steps in the issue, using a group folder and overlapping Office and Committee A memberships. Trace how group-folder rights and received-share rights are combined for the shared document. Done means a full-rights group member retains access when the same content is shared back with lower rights, including for public links.