Cannot change a share link's permissions on items inside a Team folder (updateShare fails with "Cannot increase permissions")

[HermessNRJ]

How to use GitHub

• Please use the 👍 reaction to show that you are affected by the same issue.

• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.

• Subscribe to receive notifications on status change and new comments.

Steps to reproduce

1. Nextcloud 34.0.1, Team folders (groupfolders) 22.0.2, ACL (Advanced Permissions) enabled on the Team folder.
2. A user has full access to a file inside the Team folder — confirmed with:
   occ groupfolders:permissions <id> <path> --user <user> --test → +read, +write, +create, +delete, +share,
   and the user can edit/write the file directly.
3. On that file, create a public link share as "View only" (read-only).
4. Edit the existing link and try to raise its permissions (e.g. enable "Allow upload and editing").

Expected behaviour

The share permissions are updated successfully (as for a file outside a Team folder).

Actual behaviour

The UI shows the change, then an error toast appears and it reverts. The OCS call fails:

PUT /ocs/v2.php/apps/files_sharing/api/v1/shares/
{"ocs":{"meta":{"status":"failure","statuscode":404,
"message":"Cannot increase permissions of /groupfolder/folder/file.txt"},"data":[]}}

Root cause found — inconsistent permissions between ACL and the filecache:

• occ groupfolders:permissions <id> <path> --user <user> --test returns full access (+read, +write, +create, +delete, +share).
• But a WebDAV PROPFIND of oc:permissions on the same file, same user returns read-only (RMG — no W/D/NV).
• OC\Share20\Manager::generalCreateChecks() reads the node's (read-only) permissions, so it refuses to increase the share with Cannot increase permissions.

So the ACL is computed correctly on the fly, but the permissions value stored in the filecache for these files is stale/read-only. This started after upgrading (NC 33 → 34, groupfolders → 22.0.2) and looks related to #4752 (masked read-only permissions 17 being persisted into the shared filecache).

Workaround

Rescanning the Team folder restores the correct permissions:

occ groupfolders:scan --all

After the scan, the same PROPFIND returns RMGDNVW (write is back) and changing the share link permissions works again.

Open question for maintainers

How did the filecache permissions end up persisted as read-only, and should there be a migration/repair step to reset them after the #4752 fix?

Server configuration

Operating system:

Docker Nextcloud

Web server:

Apache/2.4.67

Database:

mysql 8.0.45

PHP version:

8.5.7

Nextcloud version: (see Nextcloud admin page)

34.0.1

Team folders version:

22.0.2

Updated from an older Nextcloud/ownCloud or fresh install:

upgrade from 34.0.0

Where did you install Nextcloud from:

docker

Are you using external storage, if yes which one:

no

Are you using encryption:

no

Client configuration

Browser:

All and even in private mode

Operating system:

All

Logs

Nextcloud log (data/nextcloud.log)

Details

No related entry in nextcloud.log; the error is only returned in the OCS response

Insert your Nextcloud log here

Browser log

Browser log

PUT /ocs/v2.php/apps/files_sharing/api/v1/shares/7253

{"ocs":{"meta":{"status":"failure","statuscode":404,
"message":"Impossible d'augmenter les permissions de /groupfolder/folder/file.txt"},"data":[]}}
(message = "Cannot increase permissions of /groupfolder/folder/file.txt"")

[solracsf]

Fix upstream: nextcloud/server#61905