[Bug]: Accounts with same email cannot reset passwords or login via email

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Apparently the server won't prevent an admin from creating a new user with the same email as another user. Nor prevent a user from changing his own email address to that of another user. This will then generate an error if an attempt is made to change/reset password through email.

Steps to reproduce

create a new account with the same email as another account...

Expected behavior

the account is created without any warning

Nextcloud Server version

30

Operating system

Debian/Ubuntu

PHP engine version

None

Web server

None

Database engine version

None

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

Warning core Could not send password reset email: Could not find user

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

No response

Start by tracing the account-creation and email-change entry points, then the email password-reset and login flow described in the report. Reproduce users with duplicate email addresses and verify that the collision is handled and that password reset and email login no longer produce the reported error.