diff --git a/ChangeLog.txt b/ChangeLog.txt
index 95fe6e7d..d0e10f61 100644
--- a/ChangeLog.txt
+++ b/ChangeLog.txt
@@ -8,6 +8,7 @@ Broker:
   #462154.
 - Websockets clients are now periodically disconnected if they have not
   maintained their keepalive timer. Closes #461619.
+- Fix possible minor memory leak on acl parsing.
 
 Client library:
 - Inflight limits should only apply to outgoing messages. Closes #461620.
diff --git a/src/security_default.c b/src/security_default.c
index a5a19605..a1d3ec1d 100644
--- a/src/security_default.c
+++ b/src/security_default.c
@@ -399,6 +399,7 @@ static int _aclfile_parse(struct mosquitto_db *db)
 					rc = _add_acl_pattern(db, topic, access);
 				}
 				if(rc){
+					if(user) _mosquitto_free(user);
 					fclose(aclfile);
 					return rc;
 				}