A missing authorization issue in the `Elixir.Oban.Web.Jobs.DetailComponent` module allows unauthorized job worker substitution. The `handle event("save-job", ...)` handler fails to perform authorization checks, whereas other handlers like cancel, delete, and retry verify privileges using `can?/2`. An authenticated user with `:read only` access can send a forged `save-job` LiveView WebSocket event to overwrite a job's worker field with any other existing `Oban.Worker` module in the application. Consequently, during the next execution attempt, Oban will invoke the `perform/1` function on the module chosen by the attacker instead of the intended one. This occurs when the Oban.Web dashboard is deployed and accessible to users with limited job-management privileges.