Is it possible to call a ERC721 transfer function when you are not the Owner?

Question

Is it possible to call a ERC721 transfer function when you are not the Owner? Am pretty new to solidity so if you can plz provide your code so I can understand well. (BTW had asked question before but I was a bit confuse by he/her answer) here my code again:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import "@openzeppelin/contracts/token/ERC721/ERC721.sol";
import "@openzeppelin/contracts/utils/Counters.sol";

contract Tink is ERC721 {
    using Counters for Counters.Counter;
    Counters.Counter private _tokenIdCounter;

    constructor() ERC721("Tink", "TNT") { 

    }

    function _baseURI() internal pure override returns (string memory) {
        return "https://gateway.pinata.cloud/ipfs/QmX8ih22uNW5cDH5CeorzpTHTbsioFurgD6w5q7RKt298H";
    }


    function mint(address to)
        public returns (uint256)
    {
        require(_tokenIdCounter.current() < 3); 
        _tokenIdCounter.increment();
        _safeMint(to, _tokenIdCounter.current());

        return _tokenIdCounter.current();
    }
}

Answer 1

Yes, anybody can call the transfer functions (transferFrom and both flavors of safeTransferFrom). But typically the functions will throw if they are not authorized.

Here are the scenarios which typically will result in a successful transfer:

1. Owner of the token is calling the transfer
2. That specific token is approved to somebody else that is transferring
3. Owner of the token does "authorize for all" to somebody else that is transferring
4. Contract has "backdoored" other accessors for tokens

Answer 2

Yes, literally everybody can call any function in your contract. To restrict this behaviour, you should make the contract Ownable.

https://docs.openzeppelin.com/contracts/2.x/api/ownership