Can you let me know what you have set for allow_uploaded_avatars? It no longer is just a true/false setting, but is set to a certain trust level. And can you let me know what the trust level is of the user trying to change their avatar? And are you on the latest version of Discourse?
Here is the code for picking an avatar and the lines that return 422 responses.
Not that it couldn’t be something else deep in the codebase, but it likely is one of these 3. The first one has to do with discourse_connect_overrides_avatar and apparently we ruled that one out. I don’t think it is the second one because your curl command looks correct and includes the “uploaded” type. It could possibly still be the third one with the allow_uploaded_avatars setting which is why I’d like to know what you have that one set to.