MySQL stored procedure user privilege
It depends on the SQL SECURITY characteristic you defined when you created the procedure.
SQL SECURITY for a stored procedure can be either DEFINER or INVOKER.

If your user can not create table but the definer of the stored procedure can, then your user will be able to create a table through the stored procedure.

By default, the SQL SECURITY characteristic in MySQL is DEFINER.

To put it in a nutshell :


Stored procedure with SQL SECURITY DEFINER : runs with stored procedure creator rights
Stored procedure with SQL SECURITY INVOKER : runs with current user rights