diff --git a/src/auth/routes.ts b/src/auth/routes.ts
index 862f0ac..8dddb98 100644
--- a/src/auth/routes.ts
+++ b/src/auth/routes.ts
@@ -662,9 +662,7 @@ authRoutes.get('/profile/avatar', authRequired, async (c) => {
   return c.body(new Uint8Array(image.data!))
 })
 
-authRoutes.get('/users/:userId/avatar', authRequired, async (c) => {
-  if (!requireAdmin(c.get('user'))) return c.json({ error: 'forbidden' }, 403)
-
+authRoutes.get('/users/:userId/avatar', async (c) => {
   const userId = c.req.param('userId')
   const image = await findUserProfileImage(userId)
   if (!image) return c.body(null, 404)