[Bug]: Public pages on "Limit to group" apps not available to excluded groups users but available to guest(not logged in) users.

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

When an is limited to groups, LOGGED IN users outside those group can not access public pages of the app. For example, if I limit the calendar app to some group and users create an appointment page (with public visibility), then the users in excluded groups get 404 is they are logged in, but guest users can access the public page.

Steps to reproduce

Example with Calendar/Appointments

1. Limit the calendar app to some groups (but not other)
2. As a user in included group create an appointments page with public visibility
3. Copy appointments page URL and logout or open an incognito/private window
4. Go the URL as a logged-out/guest user - everything works
5. Login as a user of an EXCLUDED group from step 1
6. Go the URL (as a user of an EXCLUDED group) - 404 not found 🐛 💥 🐞

Expected behavior

If an app is limited to groups, members of excluded groups should be able to access public pages when they are logged in because they can access them if they logout.

Installation method

Community Manual installation with Archive

Nextcloud Server version

27

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.1

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

default fresh install

List of activated Apps

default fresh install

Nextcloud Signing status

default fresh install

Nextcloud Logs

N/A

Additional info

No response

Reproduce the issue using Calendar/Appointments: limit the calendar app to a group, create a public appointments page, then visit its URL while logged in as a user from an excluded group. Compare that result with an anonymous visit, and consider the work done when excluded logged-in users can access the same public page without changing app group restrictions.