[Bug]: Public Collaborative Tags return 403 Forbidden on PROPPATCH when assigned by non-creator (WebDAV ACL issue)

[Bubler]

⚠️ This issue respects the following points: ⚠️

• This is not a troubleshooting question, general support matter, or webserver/proxy problem, but likely a bug (if unsure, ask the Community Help Forum).
• This issue is not already reported on Github OR solved at the Community Help Forum (I've searched!).
• I'm using a maintained major version of Nextcloud Server and tested against the latest patch level. (Supported major versions and current patch levels).
• I agree to follow Nextcloud's Code of Conduct.
• I've tried my best to provide clear reproduction steps that someone unfamiliar with this bug could use to reproduce it.

Bug description

Actual behavior:
The UI fails to apply the tag. The browser console shows a 403 Forbidden error triggered by the WebDAV PROPPATCH request. It appears the WebDAV subsystem restricts tag assignment strictly to the user who originally created the tag, ignoring the public status in the database.

Steps to reproduce

1. Log in as User A (e.g., Admin).
2. Go to Settings -> Collaborative tags. Create a new tag (e.g., "Ready for dispatch") and set its access level to Public (Shared/Visible).
3. Log out and log in as User B (standard user).
4. Select any file owned by User B (even a newly created one) and attempt to assign the public tag from the dropdown list.
5. The UI shows an error: "Failed to apply tags".
   (Note: The issue is completely symmetrical. If User B creates the public tag, User B can assign it, but Admin gets a 403 error).

Expected behavior

Since the tag is configured as "Public", any user with write access to the file should be able to assign the tag successfully.

Nextcloud Server version

34

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.4

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

No response

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

Errors in browser console:
Failed to load resource: the server responded with a status of 403 (Forbidden)
xhr-request.js:128 PROPPATCH https://cloud.domain.com/remote.php/dav/systemtags/6/files 403 (Forbidden)
SystemTagPicker.vue:538 [ERROR] systemtags: Failed to apply tags {app: 'systemtags', uid: 'bingo', level: 3, error: Error: Invalid response: 403 Forbidden}

[solracsf]

Should be fixed by #64441