HeyForm CORS Misconfiguration Enabling Unauthorized GraphQL Access

HeyForm versions prior to 3.0.0-rc.8 contain a security vulnerability (CVE-2026-82291) related to Cross-Origin Resource Sharing (CORS) implementation. The application improperly reflects the request 'Origin' header in its CORS responses while explicitly allowing credentials (Access-Control-Allow-Credentials: true). This configuration permits malicious websites to make authenticated cross-origin requests to the HeyForm instance on behalf of a logged-in user. By enticing an authenticated user to visit an attacker-controlled page, an adversary can execute unauthorized GraphQL queries. This allows for the exfiltration of sensitive information, including workspaces, project details, forms, and respondent submissions. Furthermore, attackers can leverage this vulnerability to modify account settings or perform other actions within the victim's session, significantly impacting user privacy and data integrity.

Impact

The vulnerability poses a severe risk to organizations using self-hosted or managed HeyForm instances. Successful exploitation allows for unauthorized access to sensitive business data, including form submission results and respondent personally identifiable information (PII). Attackers may also modify account configurations or project settings, leading to potential service disruption or long-term persistence in the victim's account.

Recommendation

• Upgrade HeyForm to version 3.0.0-rc.8 or later immediately to patch the CORS policy configuration.
• Audit web server or application logs for requests originating from unrecognized or suspicious domains that contain sensitive GraphQL endpoints.
• Restrict CORS 'Access-Control-Allow-Origin' headers to a strict, pre-approved list of domains rather than reflecting the request 'Origin' header.