Granting User Access for Apex Classes

An authenticated or guest user can access an @AuraEnabled Apex method only when the user’s profile or an assigned permission set allows access to the Apex class.

For details on configuring user profile or permission set access to an Apex class, see Class Security in the Apex Developer Guide.