Weird case: inactive user with never-logged-in status somehow has an uploaded avatar

[copymonopoly]

Hi everyone,

I’m encountering a strange behavior on my Discourse forum and would like your advice.

Situation:

• There is a user who has never activated their email.
• Their last_seen_at shows they have never logged in.
• Despite this, the user somehow has an uploaded avatar.

What I’ve ruled out:

1. I did not manually upload or set the avatar for this user.
2. I do not have any SSO / third-party login providers enabled.
3. Gravatar is not the cause, as it requires login or active email.
4. No unusual plugins related to avatars are currently installed.
5. This forum has no bulk import of users with avatars.

Questions:

1. How could a user who has never logged in and is inactive end up with an uploaded avatar?
2. Are there any known bugs or edge cases in Discourse that could cause this?
3. What is the safest way to remove this avatar and prevent this from happening again?

Any insight would be greatly appreciated!

Thanks!

[awesomerobot (Kris)]

@copymonopoly

Gravatar is not the cause, as it requires login or active email.

Are you sure? I think we only check for the email, not login or verification. If you open the user’s preferences and try to edit their avatar… what does it show? I can see a gravatar for an account that has never logged in or verified email on my test site, for example:

[copymonopoly]

Ah, my bad — I hadn’t used Gravatar before and assumed it needed a verified or logged-in email.
Didn’t know it just checks if the address is registered on Gravatar.
I didn’t expect that one of my users’ randomly entered emails happened to have a Gravatar avatar!
Thanks for pointing that out!