collateralId = params.tokenContract.computeId(params.tokenId) = 1

CT.ownerOf(1) = User Y

CT.getApproved(1) = User Z

CT.isApprovedForAll(User Y, User X) = false

receiver = User Y
      function _validateCommitment(
        IAstariaRouter.Commitment calldata params,
        address receiver
      ) internal view {
        uint256 collateralId = params.tokenContract.computeId(params.tokenId);
        ERC721 CT = ERC721(address(COLLATERAL_TOKEN()));
        address holder = CT.ownerOf(collateralId);
        address operator = CT.getApproved(collateralId);
        if (
          msg.sender != holder &&
          receiver != holder &&
          receiver != operator &&
          !CT.isApprovedForAll(holder, msg.sender)
        ) {
          revert InvalidRequest(InvalidRequestReason.NO_AUTHORITY);
        }
        VIData storage s = _loadVISlot();
        address recovered = ecrecover(
          keccak256(
            _encodeStrategyData(
              s,
              params.lienRequest.strategy,
              params.lienRequest.merkle.root
            )
          ),
          params.lienRequest.v,
          params.lienRequest.r,
          params.lienRequest.s
        );
        if (
          (recovered != owner() && recovered != s.delegate) ||
          recovered == address(0)
        ) {
          revert IVaultImplementation.InvalidRequest(
            InvalidRequestReason.INVALID_SIGNATURE
          );
        }
      }
    uint256 collateralId = params.tokenContract.computeId(params.tokenId);
        ERC721 CT = ERC721(address(COLLATERAL_TOKEN()));
        address holder = CT.ownerOf(collateralId);
        address operator = CT.getApproved(collateralId);
    if (
          msg.sender != holder &&
          receiver != holder &&
          receiver != operator &&
          !CT.isApprovedForAll(holder, msg.sender)
        ) {
          revert InvalidRequest(InvalidRequestReason.NO_AUTHORITY);
        }
    if (
          msg.sender != holder && // true since User X is not the owner
          receiver != holder && // false since attacker passed receiver as User Y which is owner of collateral, thus failing this if condition 
          receiver != operator &&
          !CT.isApprovedForAll(holder, msg.sender)
        ) {
          revert InvalidRequest(InvalidRequestReason.NO_AUTHORITY);
        }
if (
      msg.sender != holder &&
      msg.sender != operator &&
      !CT.isApprovedForAll(holder, msg.sender)
    ) {
      revert InvalidRequest(InvalidRequestReason.NO_AUTHORITY);
    }

if (
      receiver != holder &&
      receiver != operator 
    ) {
      revert InvalidRequest(InvalidRequestReason.NO_AUTHORITY);
    }
