[Bug]: User in 2 groups, one "allow download" disabled and one "allow download" enabled, files are not accessible with 403

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• Nextcloud Server is running on 64bit capable CPU, PHP and OS.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Hello,
the Server is a Debian Bullseye and the Nextcloud Version is 25.0.2, I checked the changelog here https://nextcloud.com/de/changelog/ and Version 25.0.3 does not mention any changes regarding file permissions

The Problem is the following. As soon as a user is in 2 groups one with "allow download" disabled and one with "allow download" enabled files are not accessible.
I got a 403 error
and the sync client reports "(Access to this resource has been denied because it is in view-only mode"
But the higher rights from the group still apply because I could still delete the file in the webinterface

Steps to reproduce

1. Create 2 groups
2. add one user to both groups
3. create a folder
4. share the folder with both group, the first group get every permission (Allow editing, Allow Creating, Allow deleting, Allow resharing, Allow download), the second group gets all permissions removed, no checkbox at all is ticked
5. Upload a jpg to the folder
6. log in as the user who got the share
7. try to access the file either by Webbrowser or Syncclient

Expected behavior

Expect to be able to download the files because one group is able to download

Installation method

Community Manual installation with Archive

Operating system

Debian/Ubuntu

PHP engine version

PHP 7.4

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

No response

List of activated Apps

Enabled:
  - calendar: 4.2.3
  - circles: 25.0.0
  - cloud_federation_api: 1.8.0
  - comments: 1.15.0
  - contacts: 5.0.3
  - contactsinteraction: 1.6.0
  - dashboard: 7.5.0
  - dav: 1.24.0
  - deck: 1.8.3
  - external: 5.0.0
  - federatedfilesharing: 1.15.0
  - federation: 1.15.0
  - files: 1.20.1
  - files_pdfviewer: 2.6.0
  - files_rightclick: 1.4.0
  - files_sharing: 1.17.0
  - files_trashbin: 1.15.0
  - files_versions: 1.18.0
  - firstrunwizard: 2.14.0
  - logreader: 2.10.0
  - lookup_server_connector: 1.13.0
  - mail: 2.2.3
  - nextcloud_announcements: 1.14.0
  - notifications: 2.13.1
  - notify_push: 0.5.2
  - oauth2: 1.13.0
  - password_policy: 1.15.0
  - photos: 2.0.1
  - privacy: 1.9.0
  - provisioning_api: 1.15.0
  - recommendations: 1.4.0
  - related_resources: 1.0.3
  - richdocuments: 7.1.0
  - richdocumentscode: 22.5.802
  - serverinfo: 1.15.0
  - settings: 1.7.0
  - sharebymail: 1.15.0
  - spreed: 15.0.3
  - support: 1.8.0
  - survey_client: 1.13.0
  - systemtags: 1.15.0
  - text: 3.6.0
  - theming: 2.0.1
  - twofactor_backupcodes: 1.14.0
  - updatenotification: 1.15.0
  - user_ldap: 1.15.0
  - user_status: 1.5.0
  - viewer: 1.9.0
  - weather_status: 1.5.0
  - workflowengine: 2.7.0
Disabled:
  - activity: 2.17.0
  - admin_audit
  - bruteforcesettings
  - collectives: 2.2.1
  - encryption
  - files_external
  - files_fulltextsearch: 25.0.0
  - files_fulltextsearch_tesseract: 25.0.0
  - files_mindmap: 0.0.27
  - suspicious_login
  - twofactor_totp

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

No response

Additional info

No response

Start by reproducing the two-group share scenario described in the issue, then trace how file permissions are combined when one group disables downloads and another enables them. Done means the user can download the file through the browser and sync client while the other group permissions remain correctly enforced.