diff --git a/lib/Service/ShareService.php b/lib/Service/ShareService.php
index 7cbf06192f..a09585be74 100644
--- a/lib/Service/ShareService.php
+++ b/lib/Service/ShareService.php
@@ -276,6 +276,7 @@ public function create(ShareCreate $dto): Share {
 	 * @param string $receiverType
 	 *
 	 * @throws InternalError
+	 * @throws PermissionError
 	 *
 	 * @return Share
 	 */
@@ -290,6 +291,14 @@ private function buildBaseShare(
 			$this->logger->error($e->getMessage(), ['exception' => $e]);
 			throw new InternalError(get_class($this) . ' - ' . __FUNCTION__ . ': ' . $e->getMessage());
 		}
+		$allowedReceiverTypes = [
+			ShareReceiverType::USER,
+			ShareReceiverType::GROUP,
+			ShareReceiverType::CIRCLE,
+		];
+		if (!in_array($receiverType, $allowedReceiverTypes, true)) {
+			throw new PermissionError('Invalid share receiver type.');
+		}
 		if ($receiverType === ShareReceiverType::GROUP && !$this->shareManager->allowGroupSharing()) {
 			throw new PermissionError('Group sharing is disabled by your administrator.');
 		}
diff --git a/tests/unit/Service/ShareServiceTest.php b/tests/unit/Service/ShareServiceTest.php
index ac8ddc2e22..0de628e7f2 100644
--- a/tests/unit/Service/ShareServiceTest.php
+++ b/tests/unit/Service/ShareServiceTest.php
@@ -106,4 +106,26 @@ public function testUpdatePermissionThrowsOnContextShare(): void {
 		$this->expectException(PermissionError::class);
 		$this->shareService->updatePermission(1, 'manage', true);
 	}
+
+	public function testCreateThrowsForUnsupportedReceiverType(): void {
+		$this->mapper->expects($this->never())->method('insert');
+
+		$this->expectException(PermissionError::class);
+		$this->expectExceptionMessage('Invalid share receiver type.');
+
+		$this->shareService->create(
+			new ShareCreate(
+				1,
+				'table',
+				'',
+				'link',
+				true,
+				false,
+				false,
+				false,
+				false,
+				0,
+			)
+		);
+	}
 }