I have developed a Lightning Web Component in a sandbox, consisting of HTML, JS, some actions and a few Apex classes. I have tested this as sysadmin and as another non-sysadmin user. No problems.
With a change set I have uploaded this to our QA sandbox. As sysadmin everything is working OK, so all parts have arrived in the QA sandbox.
But trying to use the LWC as another user gives the error "You do not have access to the Apex class named XYZ". XYZ exists, I have verified that and as sysadmin the LWC works.
So of course I checked the security settings for the class on both sandboxes and they are identical.
I checked profile and permission sets of the user: identical.
The user can access the LWC, because the error complains of an Apex class that is called by the LWC.
The main difference is that the first sandbox is where the LWC is created. So it seems that something is missing in the change set, which is essential for non-sysadmin users.
I am sure I am missing something simple, but what is it?