Nextcloud: Messages can still be seen on conversation after expiring when cron is misconfigured

Summary:

Nextcloud talk has a feature called Message Expiration, Chat messages can be expired after a certain time. However the message does not really expire and can still be seen by anyone.

Steps To Reproduce:

1. Create a conversation
2. Set the message expiration Go to Settings > Moderation
3. Pick anything and using burp intercept the request and set it to 60 or 120 seconds.
4. send a message
5. wait for the message to expire
6. Copy the conversation link and open it to a new tab

Supporting Material/References:

[list any additional material (e.g. screenshots, logs, etc.)]

██████████

Impact

Messages that should expired is divulged to anyone that can access the conversation, This includes personal and group.