JupyterLab (pip package 'jupyterlab') versions >=4.1.0 <=4.5.9 and >=4.6.0 <=4.6.1 have a plugin manager lock-rule enforcement bypass vulnerability (CVE-2026-73627). Two server-side enforcement gaps allow authenticated users to circumvent administrator-imposed lock rules by making direct API requests to /lab/api/plugins, enabling or disabling locked plugins, including child plugins and those locked via the 'lock all' mechanism. This bypass can affect data integrity and bypass administrative restrictions implemented through locked plugins. The vulnerability is addressed in versions 4.5.10 and 4.6.2.

Authenticated users can bypass administrative lock rules on plugins, potentially enabling or disabling plugins that should be locked. This can lead to compromised data integrity and circumvention of security or operational restrictions such as upload/download limits enforced by locked plugins. There is no indication of remote unauthenticated exploitation or privilege escalation beyond the authenticated user level.

Upgrade affected JupyterLab installations to version 4.5.10 or later, or 4.6.2 or later, where the plugin manager lock-rule enforcement bypass is fixed. No other mitigation or temporary workaround is indicated in the available data.