'(oracle) why user has not [alter session] privilege but can alter session

the question is as the title
at the oracle19c
why a user that only has [create session]privilege,but it can alter session like this:
step1:sqlplus / as sysdba
  create user TESTUSER identified by TESTUSER;
  grant create session to TESTUSER;
step2:sqlplus TESTUSER/TESTUSER
  ALTER SESSION SET NLS_TIMESTAMP_FORMAT = 'SYYYY-MM-DD HH24:MI:SS.FF9';
  (why this user can alter session succussfully?)



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source