[Bug]: Wrong permissions when creating an email share with File drop settings

[ElSi-DVT]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

When creating an email share with the option "File drop" the user can read the files of the shared folder instead of only creating.

Steps to reproduce

1. Create a folder.
2. Create an email share with the option "File drop - Upload only" and click oon "Save share".
   
3. Back in the sharing tab you can see that instead of "File drop", "Custom permissions" is configured.
   
4. Click on "customize link" and see that at "Custom permissions" "Read" and "Create" is selected.
   
5. Try to access the share and see that you can indeed read instead of only create files.
6. Select in the sharing tab "File drop" again and it now is correct.

Expected behavior

The user should only be able to create files but not reading.

Nextcloud Server version

28.0.9

Additional Info

Password is enforced in the settings of shares.

[JamesH1978]

We are seeing this too in AIO. It is a real issue for us, as there is a window where the email recipient can view everything in a share until the permissions are manually changed back to file drop, and an even longer window if the user does not realise. Massive compliance and security issue.

AIO v9.6.0
Nextcloud Hub 8, 29.0.7

so seems to be an issue across versions, if the OP is v28

Thanks
James