[Bug]: audit log loop after uploading and overwite an existing README.md file

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

When audit log is enabled, when we upload an existing file and overwite the existing file, a loop happen in the audit.log until the user quit nextcloud

{"reqId":"ffw1aRpzsDcjk7DZHlEi","level":1,"time":"2025-04-10T13:16:44+00:00","remoteAddr":"10.89.1.3","user":"admin","app":"admin_audit","method":"POST","url":"/apps/text/session/8/sync","message":"File with id \"8\" accessed: \"/Readme.md\"","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36","version":"31.0.0.18","data":{"app":"admin_audit"}}
{"reqId":"VJgj6Vgj9Ul8XQa0VlaH","level":1,"time":"2025-04-10T13:16:46+00:00","remoteAddr":"10.89.1.3","user":"admin","app":"admin_audit","method":"POST","url":"/apps/text/session/8/sync","message":"File with id \"8\" accessed: \"/Readme.md\"","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36","version":"31.0.0.18","data":{"app":"admin_audit"}}
{"reqId":"eiVbQ13N3YdhoLcLuCog","level":1,"time":"2025-04-10T13:16:51+00:00","remoteAddr":"10.89.1.3","user":"admin","app":"admin_audit","method":"POST","url":"/apps/text/session/8/sync","message":"File with id \"8\" accessed: \"/Readme.md\"","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36","version":"31.0.0.18","data":{"app":"admin_audit"}}
{"reqId":"rmS9ts38KG1tOYvQ6C46","level":1,"time":"2025-04-10T13:16:56+00:00","remoteAddr":"10.89.1.3","user":"admin","app":"admin_audit","method":"POST","url":"/apps/text/session/8/sync","message":"File with id \"8\" accessed: \"/Readme.md\"","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36","version":"31.0.0.18","data":{"app":"admin_audit"}}
{"reqId":"YjhV6CY9UrBTDPhzjtxj","level":1,"time":"2025-04-10T13:17:02+00:00","remoteAddr":"10.89.1.3","user":"admin","app":"admin_audit","method":"POST","url":"/apps/text/session/8/sync","message":"File with id \"8\" accessed: \"/Readme.md\"","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36","version":"31.0.0.18","data":{"app":"admin_audit"}}

Steps to reproduce

1. enable audit log
2. download readme.txt
3. upload readme.txt
4. overwrite the existing file

Expected behavior

no loop and only one event should be logged

Nextcloud Server version

master

Operating system

Debian/Ubuntu

PHP engine version

None

Web server

None

Database engine version

None

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

No response

Start by reproducing the overwrite flow with audit logging enabled: download readme.txt, upload it, and overwrite the existing file. Inspect the /apps/text/session/8/sync handling and the repeated audit.log entries. Done means the loop no longer occurs and only one event is logged.