JupyterLab versions 4.1.0 through 4.5.9 and 4.6.0 through 4.6.1 contain a vulnerability that allows authenticated users to bypass plugin manager lock rules. This bypass is due to two server-side enforcement gaps, enabling users to enable or disable plugins that administrators have locked, including child plugins and those locked via the 'lock all' mechanism. The vulnerability can undermine data integrity and bypass restrictions such as download or upload limits enforced through locked plugins. The issue is fixed in versions 4.5.10 and 4.6.2.