I have a custom object whose OWD is Public Read/Write and the profile of user has Read and View All permission for that Object.
Now I have a Custom Button on that Object using Aura component I'm updating the record on click of that button. In the Controller class of Aura Component, I have not used any with sharing or without sharing keyword. There is no permission set assigned to user.
I have a record where the user is not the owner but on click of Custom Button user is able to update the record.
If I change the OWD to Public Read Only, then user is not able to update the record using custom button.
Now based on my understanding, if OWD of object is Public Read/Write then he can update record only when he has edit permission for that object. But here user is able to edit record even though his profile does not have Edit permission. Can anyone explain to me why this is happening?