The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file formats. In versions 1.7.9 through 3.3.1, the app's public file endpoint performed no share authorization. Anyone who knows a share token could read the shared file's contents even when the link share was protected by a password. PublicFileController extended OCP\AppFramework\Controller and marked its routes #[PublicPage]. Nextcloud only enforces share passwords through PublicShareMiddleware, which returns early for any controller that is not an OCP\AppFramework\PublicShareController instance — so no password, expiry, or share-type check ran for these routes. ShareFileService::loadLinkShare() compounded this by treating any token that getShareByToken() matched as…