I can reproduce this on latest develop, using two User Groups, a Host owned by the parent User Group, and a User in the child User Group with "Owned Hosts" filtering on.

This has hopefully been fixed in Foreman 1.5, as the authz system has been revamped and user groups with nesting have got added testing.

Host ownership no longer implies automatic permissions, but if you're upgrading from Foreman 1.4 then new roles and filters (based on ownership) will be created from your existing data. If you're setting up a new Foreman 1.5 instance, you can add a filter on hosts using owner_id = 1 and owner_type = Usergroup.

We're starting a test period for Foreman 1.5's new auth system, more information available at [[Auth_testing_for_Foreman_15] if you have the opportunity.

should be fixed with 1.5+