cPanel prior to 68.0.27 does not validate database and dbuser names during renames (SEC-321).
cpanel cpanel