Best-reply 3279463 permission check for Mark and Clear by Nico.b
Check the permissions and authorship of concerned node when calling the routes and not just when creating the links. Hence, I propose to add an additional access check to the controller and check the authorship or moderator role.