仅具有USAGE特权的新用户就可以删除表（MySQL）

Question

I logged into MySQL from root user.

Ran the command:-

create user new;

Then I logged in as user new. Ran the following commands:-

use test;
show grants;

The Output was:-

GRANT USAGE ON *.* TO ''@'LOCALHOST'

As I understand, the new user does not have the drop table permissions or any permissions for that matter (except USAGE) on this table.

However when I run the following:-

DROP TABLE test_table;

The query is successful. Could you please explain why is this happening? How do I disable this user from dropping tables and revoke other permissions from this user.

Thanks in advance.

Answer 1

According to the manual , there is more you need to consider:

SHOW GRANTS displays only the privileges granted explicitly to the named account. Other privileges might be available to the account, but they are not displayed. For example, if an anonymous account exists, the named account might be able to use its privileges, but SHOW GRANTS will not display them.

Answer 2

http://dev.mysql.com/doc/refman/5.1/en/create-user.html mentions CREATE USER creates a new row in the mysql.user table and assigns the account no privileges. What do you get when you run SHOW GRANTS FOR CURRENT_USER with user new?