Okay, I figured it out. I added every trust level and every possible group a user might be in to the list of allowed groups for uploading profile pictures:
However, previously it was only set to trust_level_0, so anybody with a trust level higher than TL0 was not able to upload profile pictures. The strange thing though is when I look at user profiles, everybody is in this group even if they’ve since been promoted to a higher trust level. Did something change in a recent release? It seems like if you specified TL0 as the required level for uploads that it would automatically grant that same permission to higher trust levels.