There are two important steps that should be taken to correct this:
1. NEVER run your web server as root; make sure it is configured to change to another user ID at startup time. (This is standard practice in all web server distributions, but administrators have been known to change it back to running as root anyway. Don't.)
2. Consider using a wrapper such as <URL:http://www.cs.tu-berlin.de/www/suicide.c>, user.c <URL:ftp://ftp.rz.uni-karlsruhe.de/pub/net/www/tools/cgi-src/> , or CGIwrap <URL:http://www.umr.edu/~cgiwrap> to ensure that each CGI script runs with the permissions and user ID of the user responsible for it.
If proper precautions are taken, user CGI scripts can be reasonably safe. As always, dumb mistakes that open security holes for outsiders are more likely to be the cause of problems than actual malice on the part of your own users.