Private Avatar Information Leak
tracked
satoukonya
When accessing a private avatar's URL, the webpage frontend displays the error: "Error: Avatar Not Found."
However, if the F12 Developer Tools are opened and the Network panel is inspected, information that should not be visible—such as the cover image URL, name, and description—can still be viewed. This data could potentially be exploited by third parties for illicit information gathering.
Photo Viewer
View photos in a modal
Log In
WubTheCaptain
Perhaps this is not a bug, after all? Or the design for expectation of privacy hasn't been well defined.
- Create a Public visibility avatar
- Have someone add the Public avatar to favorites (and change into it)
- Change the avatar visibility to now be Private
- Have the other person check their Favorite avatars in-app again, they are able to see the name and photo of that avatar with a "?" performance rank, but no other details of that avatar.
WubTheCaptain
Additionally it's been noted in the May 1, 2026 developer Q&A stream: https://ask.vrchat.com/t/may-1-2026-developer-stream-q-a-summary/48386#p-89302-improving-user-privacy-options-avatar-changes-visible-in-api-14
> A: Avatar changes being visible via API is partly intentional - clients need to know what avatar someone is wearing, and restricting that breaks things. The bigger issue is we’ve never formally defined what level of privacy users should expect in VRChat - we haven’t made that promise technologically or via policy, and we need to. That’s something we’re aware of and have to address. [...]
WubTheCaptain
The social tab / friends list also needs to know which private avatars are worn by users to display the avatar photos in there.
WubTheCaptain
Notably, this bug doesn't extend to avatars that have been taken down due to a DMCA takedown notice ("Error: This avatar is unavailable․"), such as
avtr_72509025-0307-447e-b572-e9ecfbdc9548
.WubTheCaptain
This information leak also doesn't apply to private avatars that have been deleted (such as
avtr_3167bbef-47d4-425f-8aab-4f8dfc0aae8e
).
StormRel
marked this post as
tracked