Background information: We have a "mixed" Confluence install: most spaces are private to the company but some of them are available to the public. As such, we have set the permissions for these specific spaces to allow anonymous access.

Avatars are hidden by Confluence in these situations (with and without "View User Profiles" enabled for anonymous users under the Global Permissions), which is perfect.

Problem: when viewing a space as an anonymous user, Confluence links to /download/attachments/123456/abc under, for instance, "Recent space activity". The HTTP request then gets redirected to the login page, which results in a broken image. The dashboard page, however, correctly shows the placeholder avatar and does not try to embed the user avatar.