Privileges Provided by MySQL • SYSTEM_VARIABLES_ADMIN •Enables system variable changes at runtime: •Enables server configuration changes to global system variables with  SET GLOBAL  and  SET PERSIST . •Enables server configuration changes to global system variables with  SET PERSIST_ONLY , if the user also has  PERSIST_RO_VARIABLES_ADMIN . •Enables setting restricted session system variables that require a special privilege. In effect, SYSTEM_VARIABLES_ADMIN  implies  SESSION_VARIABLES_ADMIN  without explicitly granting SESSION_VARIABLES_ADMIN . •Enables changes to global transaction characteristics (see Section 13.3.7, “SET TRANSACTION Statement” ). • TABLE_ENCRYPTION_ADMIN  (added in MySQL 8.0.16) • VERSION_TOKEN_ADMIN • XA_RECOVER_ADMIN • FILE  can be abused to read into a database table any files that the MySQL server can read on the server host. This includes all world-readable files and files in the server’s data directory. The table can then be accessed using  SELECT  to transfer its contents to the client host. • GRANT OPTION  enables users to give their privileges to other users. Two users that have different privileges and with the  GRANT OPTION  privilege are able to combine privileges. Affects the following operations and server behaviors: See also Section 5.1.9.1, “System Variable Privileges” . Enables a user to override default encryption settings when  table_encryption_privilege_check is enabled; see Defining an Encryption Default for Schemas and General Tablespaces. Enables execution of Version Tokens functions. This privilege is defined by the  version_tokens plugin; see Section 5.6.6, “Version Tokens” . Enables execution of the  XA RECOVER  statement; see Section 13.3.8.1, “XA Transaction SQL Statements” . Prior to MySQL 8.0, any user could execute the  XA RECOVER  statement to discover the XID values for outstanding prepared XA transactions, possibly leading to commit or rollback of an XA transaction by a user other than the one who started it. In MySQL 8.0,  XA RECOVER  is permitted only to users who have the  XA_RECOVER_ADMIN  privilege, which is expected to be granted only to administrative users who have need for it. This might be the case, for example, for administrators of an XA application if it has crashed and it is necessary to find outstanding transactions started by the application so they can be rolled back. This privilege requirement prevents users from discovering the XID values for outstanding prepared XA transactions other than their own. It does not affect normal commit or rollback of an XA transaction because the user who started it knows its XID. It is a good idea to grant to an account only those privileges that it needs. You should exercise particular caution in granting the  FILE  and administrative privileges: Privilege-Granting Guidelines 1201