CVE-2022-4863: usememos/memos vulnerable to Improper Handling of Insufficient Permissions or Privileges

The vulnerability stemmed from missing authorization checks after resource retrieval in multiple handlers. The patch added explicit creator ID verification post-fetch (e.g., checking memo.CreatorID != userID) where previously authorization was only enforced through query parameters. This pattern was present in memo, resource, and shortcut handlers. The JSON struct tag additions (json:"-") in API models prevent malicious parameter injection, but the core vulnerability was in the server-side handlers' authorization flow.