New group members should see existing shares

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Newly created users (via OIDC using Keycloak) don't see a previously created share. After recreating the share and the users can see the share.

Steps to reproduce

Users: A, B and C
Group: G
Share: S

1. A (a keycloak account) created a share S and shared with B (my account, not a keycloak account)
2. B shared with the keycloak group G
3. the newly created account C (a keycloak account), who is member of the group G, doesn't see the share S

Expected behavior

That newly created accounts see this folder. It works if:

• it is directly shared with them
• or also e.g. chats where the group is invited

Nextcloud Server version

31

Operating system

None

PHP engine version

None

Web server

None

Database engine version

None

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "** REMOVED **"
        ],
        "dbtype": "pgsql",
        "version": "31.0.7.1",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "dbpersistent": true,
        "installed": true,
        "maintenance": false,
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "loglevel": 2,
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "overwriteprotocol": "https",
        "overwrite.cli.url": "https:\/\/cloud.permaplant.net",
        "preview_max_x": 2048,
        "preview_max_y": 2048,
        "upgrade.disable-web": true,
        "maintenance_window_start": 22,
        "default_phone_region": "AT",
        "chunkSize": "5120MB",
        "auth.bruteforce.protection.enabled": true,
        "skeletondirectory": "\\srv\\nextcloud_user_template",
        "auth.webauthn.enabled": false,
        "app.mail.verify-tls-peer": false,
        "mail_smtpmode": "smtp",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_sendmailmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": 587,
        "mail_smtpsecure": "tls",
        "mail_smtpauthtype": "PLAIN",
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "user_oidc": {
            "selfencoded_bearer_validation_audience_check": false,
            "selfencoded_bearer_validation_azp_check": false,
            "allow_multiple_user_backends": 0
        },
        "memories.db.triggers.fcu": true,
        "memories.exiftool": "\/var\/www\/html\/custom_apps\/memories\/bin-ext\/exiftool-amd64-glibc",
        "memories.vod.path": "\/var\/www\/html\/custom_apps\/memories\/bin-ext\/go-vod-amd64"
    }
}

List of activated Apps

- activity: 4.0.0
  - admin_audit: 1.21.0
  - analytics: 5.7.1
  - announcementcenter: 7.1.4
  - app_api: 5.0.2
  - bookmarks: 15.1.2
  - bruteforcesettings: 4.0.0
  - calendar: 5.3.6
  - circles: 31.0.0
  - cloud_federation_api: 1.14.0
  - collectives: 3.0.2
  - comments: 1.21.0
  - contacts: 7.2.0
  - contactsinteraction: 1.12.0
  - cookbook: 0.11.3
  - cospend: 3.0.11
  - dashboard: 7.11.0
  - dav: 1.33.0
  - deck: 1.15.1
  - external: 6.0.2
  - federatedfilesharing: 1.21.0
  - federation: 1.21.0
  - files: 2.3.1
  - files_downloadlimit: 4.0.0
  - files_external: 1.23.0
  - files_pdfviewer: 4.0.0
  - files_reminders: 1.4.0
  - files_sharing: 1.23.1
  - files_trashbin: 1.21.0
  - files_versions: 1.24.0
  - firstrunwizard: 4.0.0
  - forms: 5.1.2
  - groupfolders: 19.1.2
  - integration_gitlab: 3.2.0
  - logreader: 4.0.0
  - lookup_server_connector: 1.19.0
  - nextcloud_announcements: 3.0.0
  - notes: 4.12.2
  - notifications: 4.0.0
  - oauth2: 1.19.1
  - password_policy: 3.0.0
  - passwords: 2025.7.20
  - photos: 4.0.0
  - polls: 8.1.4
  - previewgenerator: 5.9.0
  - privacy: 3.0.0
  - profile: 1.0.0
  - provisioning_api: 1.21.0
  - quota_warning: 1.21.0
  - recommendations: 4.0.0
  - related_resources: 2.0.0
  - serverinfo: 3.0.0
  - settings: 1.14.0
  - sharebymail: 1.21.0
  - spreed: 21.1.2
  - support: 3.0.0
  - systemtags: 1.21.1
  - text: 5.0.0
  - theming: 2.6.1
  - twofactor_backupcodes: 1.20.0
  - updatenotification: 1.21.0
  - uppush: 2.3.0
  - user_oidc: 7.2.0
  - user_status: 1.11.0
  - viewer: 4.0.0
  - weather_status: 1.11.0
  - webhook_listeners: 1.2.0
  - workflowengine: 2.13.0

Nextcloud Signing status

Nextcloud Logs

Additional info

No response

No source files, tests, or entry points are named. Start by reproducing the A/B/C scenario on Nextcloud Server 31 with the user_oidc app and Keycloak, focusing on group-shared folders and newly created group members. Done means account C can see folder S without recreating the share, matching direct shares and group-invited chats.