---
id: CVE-2000-0725
aliases:
  - GHSA-9cmq-pj6p-hgwf
  - PYSEC-2026-757
title: Zope does not properly restrict access to the getRoles method
summary: Zope does not properly restrict access to the getRoles method
severity: high
vendor: zope
product: zope
ecosystem: pip
affected:
  - zope < 2.2.1
patched:
  - zope 2.2.1
published: '2022-04-30'
updated: '2026-07-06'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-9cmq-pj6p-hgwf'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2000-0725'
  - url: >-
      https://web.archive.org/web/20010219192346/http://archives.neohapsis.com/archives/bugtraq/2000-08/0198.html
  - url: >-
      https://web.archive.org/web/20010219192441/http://archives.neohapsis.com/archives/bugtraq/2000-08/0259.html
  - url: >-
      https://web.archive.org/web/20010228172804/http://www.securityfocus.com/bid/1577
  - url: 'http://www.debian.org/security/2000/20000821'
  - url: 'http://www.redhat.com/support/errata/RHSA-2000-052.html'
  - url: 'http://www.zope.org/Products/Zope/Hotfix_08_09_2000/security_alert'
tags:
  - osv
  - pip
epss: 0.00471
epssPercentile: 0.39753
ingestedAt: '2026-07-08T18:25:47.829Z'
---

## Overview

Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by modifying the roles list that is included in a request.

## Affected packages

- `zope < 2.2.1`

## Remediation

Upgrade to a patched release:

- `zope 2.2.1`