Issue #3496790: Logic problem in the Addressbook controller.

modules/order/src/Controller/AddressBookController.php

@@ -295,7 +295,7 @@ class AddressBookController implements ContainerInjectionInterface {
     $result = $access_control_handler->createAccess($profile_type->id(), $account, [
       'profile_owner' => $user,
     ], TRUE);
-    if ($result->isAllowed()) {
+    if (!$result->isAllowed()) {
       // There is no create any/own permission, confirm that the account is
       // either an administrator, or they're creating a profile for themselves.
       $admin_permission = $this->entityTypeManager->getDefinition('profile')->getAdminPermission();