Privilege Escalation - A Non Owner User Who Does not Have access to the user management can invite other users to the restaurant page

Summary

An unauthorised business user was able to invite other users to become members of the same business account without being visible in the User Management page.

Yelp Business has a option where the owner can invite the other users to their Business account and when the new user gets added to the business account, they can perform every functionality except the user management module.

Using this vulnerability, a user with no access to the user management module can invite other users to the business. Once the attacker invites the user, the owner cannot see the new user that got invited.