In cPanel prior to 67.9999.103, a user account's backup archive could contain all MySQL databases on the server (SEC-284).
cpanel cpanel