Besides mentioned #10485 we also fix a similar memleak (updating user)
that introduced by the same commit 5b32bb7f ("alter: Refactor
access_check outside constructors").

Closes #10485
Part-of #10211

NO_TEST=covered by existing tests
NO_DOC=bugfix

(cherry picked from commit 84f10be00824348844c9e1997bd813b881836928)