diff --git a/x-pack/plugins/security/server/routes/user_profile/update.ts b/x-pack/plugins/security/server/routes/user_profile/update.ts
index 882c887a05ffa4..9a550ada52adc1 100644
--- a/x-pack/plugins/security/server/routes/user_profile/update.ts
+++ b/x-pack/plugins/security/server/routes/user_profile/update.ts
@@ -51,7 +51,7 @@ export function defineUpdateUserProfileDataRoute({
 
       const userProfileData = request.body;
       const imageDataUrl = userProfileData.avatar?.imageUrl;
-      if (imageDataUrl) {
+      if (imageDataUrl && typeof imageDataUrl === 'string') {
         const matches = imageDataUrl.match(/^data:([A-Za-z-+\/]+);base64,(.+)$/);
         if (!matches || matches.length !== 3) {
           return response.customError({
diff --git a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/internal/user_actions_get_users.ts b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/internal/user_actions_get_users.ts
index b274049ad7f867..c1edd4280be85e 100644
--- a/x-pack/test/cases_api_integration/security_and_spaces/tests/common/internal/user_actions_get_users.ts
+++ b/x-pack/test/cases_api_integration/security_and_spaces/tests/common/internal/user_actions_get_users.ts
@@ -474,7 +474,8 @@ export default ({ getService }: FtrProviderContext): void => {
               initials: 4,
               // @ts-expect-error: types are not correct
               color: true,
-              imageUrl: IMAGE_URL_TEST,
+              // @ts-expect-error: types are not correct
+              imageUrl: [],
             },
             headers: superUserHeaders,
           });