Environment

• Zabbix server and frontend 8.0.0 (tag "8.0.0", commit "c81e276e505"), PostgreSQL 16.15.

Steps to reproduce

1. In Services → Services switch to Edit mode and create "Service A", "Service B" and "Service C" with Create service. Set Problem tags "service" equals "A", "B" and "C".
2. In Users → User roles create role "svc-list" with User type "User". Set Read-only access to services to "Service list" with "Service A", "Service B" and "Service C". Set Read-write access to services to "None".
3. In Users → Users create user "svc-user" with role "svc-list", any user group and media "Email".
4. Add media "Email" to user "Admin".
5. In Alerts → Actions → Service actions create action "svc-notify" with no conditions and operation "Send message" to users "svc-user" and "Admin".
6. Create host "svc-test" with items "tA", "tB" and "tC", type "Zabbix trapper", type of information "Numeric (unsigned)".
7. Create triggers "Problem A", "Problem B" and "Problem C" with expressions "last(/svc-test/tA)=1", "last(/svc-test/tB)=1", "last(/svc-test/tC)=1" and tags "service" = "A", "B" and "C".
8. Send value 1 to all three items, for example "zabbix_sender -z 127.0.0.1 -s svc-test -k tA -o 1".
9. Open Reports → Action log or run query from block 1.

1. Query

SELECT s.serviceid, s.name AS service, u.username
FROM alerts a
JOIN events e ON e.eventid = a.eventid
JOIN services s ON s.serviceid = e.objectid
JOIN users u ON u.userid = a.userid
JOIN actions ac ON ac.actionid = a.actionid
WHERE ac.name = 'svc-notify'
ORDER BY s.name, u.username;

Result

All three services change status to "High", and "svc-user" sees all three in Services → Services. Action creates alerts for "Admin" for all three services, but for "svc-user" only for "Service A":

 serviceid |  service  | username
-----------+-----------+----------
        31 | Service A | Admin
        31 | Service A | svc-user
        32 | Service B | Admin
        33 | Service C | Admin

Expected

"svc-user" gets message for every service in Read-only access to services list and for their child services. Documentation says read-only access "is dynamically inherited by the child services" (User roles).
Affects service action messages for users whose role has more than one service in "Service list".