[Bug]: Email notifications are not sent when an anonymous external user uploads a file to a folder shared by email

⚠️ This issue respects the following points: ⚠️

• This is not a troubleshooting question, general support matter, or webserver/proxy problem, but likely a bug (if unsure, ask the Community Help Forum).
• This issue is not already reported on Github OR solved at the Community Help Forum (I've searched!).
• I'm using a maintained major version of Nextcloud Server and tested against the latest patch level. (Supported major versions and current patch levels).
• I agree to follow Nextcloud's Code of Conduct.
• I've tried my best to provide clear reproduction steps that someone unfamiliar with this bug could use to reproduce it.

Bug description

Bug description

Email notifications are not sent when an anonymous external user uploads a file to a folder shared by email (ShareByMail).

The folder owner has enabled the following Activity email notification:

Files have been uploaded to a folder shared by mail or by public link

The external recipient can access the shared folder and upload files successfully.

However, no email notification is sent to the folder owner.

SMTP and background jobs are working correctly.

As a test, enabling the generic Activity email notification:

A file or folder has been modified

causes an email to be sent for the same external upload.

So the email delivery itself seems to be working, but the upload does not appear to be handled by the dedicated "public link / email share upload" Activity notification.

Activity generated by the upload

After an anonymous external upload through the ShareByMail link, the activity is recorded as:

app = files
type = file_created
subject = created_by

The corresponding subjectparams is:

[{"<file_id>":"<redacted_file_path>"},""]

The actor identifier in subjectparams is therefore empty.

What I found in the Activity code

Looking at FilesHooks::fileCreate() in the Activity app, if I understand the code correctly:

if ($this->currentUser->getUserIdentifier() !== '' || !$this->currentUser->isPublicShareToken()) {
    $this->addNotificationsForFileAction($path, Files::TYPE_SHARE_CREATED, 'created_self', 'created_by');
} else {
    $this->addNotificationsForFileAction($path, Files_Sharing::TYPE_PUBLIC_UPLOAD, '', 'created_public');
}

I also checked CurrentUser::isPublicShareToken(), which seems to explicitly support both link and email shares:

return $share->getShareType() === IShare::TYPE_LINK
    || $share->getShareType() === IShare::TYPE_EMAIL;

If I understand this correctly, an anonymous upload through a ShareByMail share should normally be classified as TYPE_PUBLIC_UPLOAD / created_public.

Since the recorded subjectparams contains an empty actor identifier, my understanding is that getUserIdentifier() was empty for this request.

However, the resulting activity is still created_by instead of created_public.

Could this mean that isPublicShareToken() is returning false during the ShareByMail upload?

Could you confirm whether this interpretation is correct and whether an anonymous ShareByMail upload is expected to generate a TYPE_PUBLIC_UPLOAD Activity event?

### Steps to reproduce

1. Enable email notifications for uploads to folders shared by email/public link.
2. Share a folder with an external email address.
3. Upload a file through the ShareByMail link without being authenticated.
4. No email notification is received.
5. Enable the generic "A file or folder has been modified" notification and repeat: the email is received.

### Expected behavior

The folder owner should receive an email notification when an external user uploads a file through the ShareByMail link.

### Nextcloud Server version

33

### Operating system

Debian/Ubuntu

### PHP engine version

PHP 8.3

### Web server

Apache (supported)

### Database engine version

PostgreSQL

### Is this bug present after an update or on a fresh install?

None

### Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

### What user-backends are you using?

- [ ] Default user-backend _(database)_
- [x] LDAP/ Active Directory
- [ ] SSO - SAML
- [ ] Other

### Configuration report

```json
{
    "system": {
        "one-click-instance": true,
        "one-click-instance.user-limit": 100,
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "check_data_directory_permissions": false,
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "timeout": 3,
            "read_timeout": 10,
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "overwritehost": "otc-nextcloud.sitec.corsica",
        "overwriteprotocol": "https",
        "serverid": 473,
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "localhost",
            "otc-nextcloud.sitec.corsica"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "pgsql",
        "version": "33.0.3.2",
        "overwrite.cli.url": "https:\/\/otc-nextcloud.sitec.corsica\/",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "maintenance": false,
        "updatechecker": false,
        "loglevel": 2,
        "log_type": "file",
        "log_type_audit": "file",
        "logfile": "\/var\/www\/html\/data\/nextcloud.log",
        "logfile_audit": "\/var\/www\/html\/data\/audit.log",
        "log_rotate_size": 10485760,
        "log.condition": {
            "apps": [
                "admin_audit"
            ]
        },
        "preview_max_x": 2048,
        "preview_max_y": 2048,
        "jpeg_quality": 60,
        "enabledPreviewProviders": {
            "1": "OC\\Preview\\Image",
            "2": "OC\\Preview\\MarkDown",
            "3": "OC\\Preview\\MP3",
            "4": "OC\\Preview\\TXT",
            "5": "OC\\Preview\\OpenDocument",
            "6": "OC\\Preview\\Movie",
            "7": "OC\\Preview\\Krita"
        },
        "enable_previews": true,
        "upgrade.disable-web": true,
        "mail_smtpmode": "smtp",
        "trashbin_retention_obligation": "auto, 30",
        "versions_retention_obligation": "auto, 30",
        "activity_expire_days": 30,
        "simpleSignUpLink.shown": false,
        "share_folder": "\/Shared",
        "one-click-instance.link": "https:\/\/nextcloud.com\/all-in-one\/",
        "upgrade.cli-upgrade-link": "https:\/\/github.com\/nextcloud\/all-in-one\/discussions\/2726",
        "updatedirectory": "\/nc-updater",
        "maintenance_window_start": 100,
        "allow_local_remote_servers": true,
        "davstorage.request_timeout": 3600,
        "documentation_url.server_logs": "https:\/\/github.com\/nextcloud\/all-in-one\/discussions\/5425",
        "htaccess.RewriteBase": "\/",
        "dbpersistent": false,
        "auth.bruteforce.protection.enabled": true,
        "ratelimit.protection.enabled": true,
        "files_external_allow_create_new_local": false,
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "onlyoffice": {
            "editors_check_interval": 0,
            "jwt_secret": "***REMOVED SENSITIVE VALUE***",
            "jwt_header": "AuthorizationJwt"
        },
        "defaultapp": "dashboard,files",
        "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory",
        "twofactor_enforced": "true",
        "twofactor_enforced_groups": [
            "G_NC_MFA"
        ],
        "twofactor_enforced_excluded_groups": [],
        "app_install_overwrite": [
            "files_archive",
            "files_trackdownloads"
        ],
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauth": true,
        "mail_smtpport": "587",
        "mail_sendmailmode": "smtp",
        "mail_smtpstreamoptions": {
            "ssl": {
                "allow_self_signed": false,
                "verify_peer": true,
                "verify_peer_name": true
            }
        },
        "DOMAIN": "otc-nextcloud.sitec.corsica",
        "AIO_VERSION": "v13.1.0"
    }
}

List of activated Apps

Enabled:
  - activity: 6.0.0
  - admin_audit: 1.23.0
  - bruteforcesettings: 6.0.0
  - circles: 33.0.0
  - cloud_federation_api: 1.17.0
  - comments: 1.23.0
  - contactsinteraction: 1.14.1
  - dav: 1.36.0
  - federatedfilesharing: 1.23.0
  - federation: 1.23.0
  - files: 2.5.0
  - files_archive: 1.2.8
  - files_downloadlimit: 5.1.0
  - files_pdfviewer: 6.0.0
  - files_reminders: 1.6.0
  - files_sharing: 1.25.2
  - files_trashbin: 1.23.0
  - files_versions: 1.26.0
  - firstrunwizard: 6.0.0
  - groupfolders: 21.0.7
  - logreader: 6.0.0
  - lookup_server_connector: 1.21.0
  - nextcloud-aio: 0.8.0
  - nextcloud_announcements: 5.0.0
  - notifications: 6.0.0
  - notify_push: 1.4.0
  - oauth2: 1.21.0
  - onlyoffice: 10.1.2
  - password_policy: 5.0.0
  - privacy: 5.0.0
  - profile: 1.2.0
  - provisioning_api: 1.23.0
  - recommendations: 6.0.0
  - related_resources: 4.0.0
  - serverinfo: 5.0.0
  - settings: 1.16.0
  - sharebymail: 1.23.0
  - support: 5.0.0
  - survey_client: 5.0.0
  - systemtags: 1.23.0
  - text: 7.0.1
  - theming: 2.8.0
  - twofactor_backupcodes: 1.22.0
  - twofactor_totp: 15.0.0
  - updatenotification: 1.23.0
  - user_ldap: 1.24.0
  - user_status: 1.13.0
  - viewer: 6.0.0
  - weather_status: 1.13.0
  - webhook_listeners: 1.5.0
  - workflowengine: 2.15.0
Disabled:
  - app_api: 33.0.0 (installed 33.0.0)
  - calendar: 6.4.2 (installed 6.4.2)
  - contacts: 8.5.1 (installed 8.5.1)
  - dashboard: 7.13.0 (installed 7.13.0)
  - deck: 1.17.1 (installed 1.17.1)
  - encryption: 2.21.0
  - files_external: 1.25.1
  - files_trackdownloads: 1.11.0 (installed 1.11.0)
  - flow_notifications: 4.0.0 (installed 4.0.0)
  - notes: 5.0.0 (installed 5.0.0)
  - photos: 6.0.0 (installed 6.0.0)
  - suspicious_login: 11.0.0
  - tasks: 0.17.1 (installed 0.17.1)
  - testing: 1.23.0
  - twofactor_nextcloud_notificati

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

Additional info

PHP 8.3.31 (cli) (built: May 7 2026 16:48:21) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.3.31, Copyright (c) Zend Technologies
with Zend OPcache v8.3.31, Copyright (c), by Zend Technologies

psql (PostgreSQL) 18.4

Server version: Apache/2.4.67 (Unix)
Server built: May 5 2026 17:40:43

Start with the Activity app's FilesHooks::fileCreate() and CurrentUser::isPublicShareToken(), then reproduce the upload through a ShareByMail link using the listed steps. Compare the generated activity type and notification behavior for anonymous ShareByMail uploads; done means the folder owner receives the dedicated upload email notification.