How to reproduce:

• create "host1" and add it to "host group1"
• create "host2" and add it to "host group2"
• create "user group1" and add deny permissions to "host group1"
• create "user group2" and add read permissions to "host group1" and "host group2"
• create "user" and add him to "user group1" and "user group2"
• check user permissions

Accordingly to frontend he has "read" permissions for both host groups. Which is misleading because he has "deny" permissions to "host group1" and "Zabbix server1" host.

Zabbix 3.2 and 3.4 aren't affected.