Privilege Escalation - A Low Privilege User who does not have access to the user management module can remove the owner of the business account

Summary

An unauthorised business user can remove the owner of the business account.

Yelp Business had an option to invite other users to application and when the new user gets added to the business they can perform every functionality except access to the user management module which includes deleting the users.

There is a privilege escalation vulnerability allowing a low privilege user to remove the owner of the business.

Thanks to the Yelp team for looking into this submission.