[Bug]: Inconsistent sharing permissions after parent directory access is revoked

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

A file created by a user (UserA) inside a group folder becomes an orphaned reference at the root of userB file space after UserA is removed from the group. This orphaned file is visible in the web interface of UserB, but it is not functional. Any attempt to interact with it—via the sync client, move action, or OnlyOffice—fails with a "file not found" or a similar permissions error.

Steps to reproduce

1. User A is a member of group "G" and has access to a group folder (Team_Folder).
2. User A creates a file (MyFile.docx) and moves it into Team_Folder.
3. User A shares MyFile.docx with User B, who is not in group "G."
4. User A is removed from group "G."
5. After User A is removed, the file MyFile.docx appears in User B's file space, but it cannot be synchronized, moved, or opened (e.g., with OnlyOffice), resulting in a "file not found" error.
6. User A is re-added to group "G."
7. The file MyFile.docx becomes fully functional again for User B, who can now move, sync, and open it.

Expected behavior

The file MyFile.docx becomes fully functional for User B, who can move, sync, and open it regardless of whether User A has access to the file.

Nextcloud Server version

31

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Nginx

Database engine version

PostgreSQL

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 31 to 32)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

php occ config:list system
{
    "system": {
        "memcache.local": "\\OC\\Memcache\\Redis",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "localhost",
            "www.intranet.disp-lab.fr",
            "nuage-porte-1",
            "intranet.disp-lab.fr"
        ],
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "overwritehost": "www.intranet.disp-lab.fr",
        "overwriteprotocol": "https",
        "overwritewebroot": "\/",
        "overwirtecondaddr": "^172\\.1[89]\\.0\\.[38]$",
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "pgsql",
        "version": "31.0.8.1",
        "overwrite.cli.url": "https:\/\/www.intranet.disp-lab.fr",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "maintenance": false,
        "theme": "",
        "loglevel": "2",
        "ldapIgnoreNamingRules": false,
        "mail_smtpmode": "smtp",
        "mail_smtpsecure": "tls",
        "mail_sendmailmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauthtype": "LOGIN",
        "mail_smtpauth": 1,
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "app_install_overwrite": [
            "groupfolders",
            "files_mindmap",
            "files_rightclick",
            "whiteboard"
        ],
        "onlyoffice": {
            "api_url": "https:\/\/www.intranet.disp-lab.fr\/richdocumentscode\/",
            "verify_peer_off": true,
            "jwt_secret": "***REMOVED SENSITIVE VALUE***"
        },
        "allow_local_remote_servers": "true",
        "force_language": "fr",
        "default_locale": "fr_FR",
        "force_locale": "fr_FR",
        "default_language": "fr",
        "default_phone_region": "FR",
        "maintenance_window_start": "3",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379,
            "password": "***REMOVED SENSITIVE VALUE***"
        },
        "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory",
        "app.theming.use_cached_icons": "no",
        "data-fingerprint": "8130caff684e7b912bf0e0780c50e98d"
    }
}

List of activated Apps

php occ app:list
Enabled:
  - activity: 4.0.0
  - admin_audit: 1.21.0
  - announcementcenter: 7.1.4
  - app_api: 5.0.2
  - bruteforcesettings: 4.0.0
  - calendar: 5.5.1
  - circles: 31.0.0
  - cloud_federation_api: 1.14.0
  - comments: 1.21.0
  - contacts: 7.2.6
  - contactsinteraction: 1.12.0
  - dashboard: 7.11.0
  - dav: 1.33.0
  - drawio: 3.1.0
  - event_update_notification: 2.6.1
  - external: 6.0.2
  - federatedfilesharing: 1.21.0
  - federation: 1.21.0
  - files: 2.3.1
  - files_downloadlimit: 4.0.0
  - files_mindmap: 0.0.33
  - files_pdfviewer: 4.0.0
  - files_reminders: 1.4.0
  - files_sharing: 1.23.1
  - files_trashbin: 1.21.0
  - files_versions: 1.24.0
  - firstrunwizard: 4.0.0
  - forms: 5.1.2
  - groupfolders: 19.1.3
  - ldap_write_support: 1.13.0
  - logreader: 4.0.0
  - lookup_server_connector: 1.19.0
  - nextcloud_announcements: 3.0.0
  - notes: 4.12.3
  - notifications: 4.0.0
  - oauth2: 1.19.1
  - onlyoffice: 9.10.0
  - password_policy: 3.0.0
  - photos: 4.0.0
  - polls: 8.3.8
  - privacy: 3.0.0
  - profile: 1.0.0
  - provisioning_api: 1.21.0
  - recommendations: 4.0.0
  - related_resources: 2.0.0
  - serverinfo: 3.0.0
  - settings: 1.14.0
  - sharebymail: 1.21.0
  - spreed: 21.1.3
  - support: 3.0.0
  - survey_client: 3.0.0
  - systemtags: 1.21.1
  - text: 5.0.0
  - theming: 2.6.1
  - twofactor_backupcodes: 1.20.0
  - updatenotification: 1.21.0
  - user_ldap: 1.22.0
  - user_status: 1.11.0
  - viewer: 4.0.0
  - weather_status: 1.11.0
  - webhook_listeners: 1.2.0
  - whiteboard: 1.1.3
  - workflowengine: 2.13.0
Disabled:
  - encryption: 2.19.0
  - files_external: 1.23.0
  - files_rightclick: 0.15.1 (installed 1.6.0)
  - registration: 2.7.0 (installed 2.7.0)
  - suspicious_login: 9.0.1
  - twofactor_nextcloud_notification: 5.0.0
  - twofactor_totp: 13.0.0-dev.0

Nextcloud Signing status

Technical information
=====================
The following list covers which files have failed the integrity check. Please read
the previous linked documentation to learn more about the errors and how to fix
them.

Results
=======
- files_mindmap
	- EXCEPTION
		- OC\IntegrityCheck\Exceptions\InvalidSignatureException
		- Certificate is not valid.

Raw output
==========
Array
(
    [files_mindmap] => Array
        (
            [EXCEPTION] => Array
                (
                    [class] => OC\IntegrityCheck\Exceptions\InvalidSignatureException
                    [message] => Certificate is not valid.
                )

        )

)

Nextcloud Logs

Additional info

I think this issue exists with a shared folder from another user, like User C, and it seems to exist for me in all versions.

Start by reproducing the six-step scenario with the groupfolders and files_sharing apps, focusing on the share after User A is removed from group G. Verify behavior through the web interface, sync client, move action, and OnlyOffice. Done means User B's shared file remains functional after User A loses access, including opening, moving, and synchronizing it.