JupyterLab versions from 4.1.0 up to but not including 4.6.2 have a vulnerability in the plugin manager that allows authenticated users to bypass administrator-enforced plugin lock rules via direct API requests. This bypass affects child plugins of multi-plugin extensions and scenarios where administrators issued a 'lock all' command. The vulnerability can impact data integrity and circumvent restrictions implemented through locked plugins. Fixed in JupyterLab 4.6.2 and 4.5.10.