What about 'site permissions' ?

Is 'can upload avatar' set for his group?