An Incorrect Authorization issue was discovered in fossbilling/fossbillin before 0.5.0. Promotions applied to certain client groups are still being honored even after the promotions are no longer applicable to those groups. This means that attackers can potentially gain access to discounted products that should not be available to them, leading to revenue loss and jeopardizing the trust of your customers.