A permissive Cross-Origin Resource Sharing (CORS) configuration in HeyForm allows remote attackers to perform unauthorized actions on behalf of authenticated users, leading to full data exposure.

The application incorrectly reflects the request Origin header in CORS responses while enabling credentials, which permits malicious cross-origin requests. This flaw allows an attacker to execute GraphQL queries as an authenticated user without requiring direct interaction beyond visiting a malicious site.

The exploitation of this vulnerability poses a severe risk to data confidentiality and integrity. By executing unauthorized GraphQL queries, an attacker can exfiltrate sensitive information, including submissions and respondent data, or modify account settings and workspace configurations. Given the CVSS score of 8.1, the vulnerability is classified as High, reflecting the potential for significant unauthorized access to proprietary and user-provided data.

Immediate Action: Update HeyForm to version 3.0.0-rc.8 or later, which corrects the CORS policy to prevent unauthorized cross-origin interactions.

Proactive Monitoring: Review web server and application logs for anomalous GraphQL requests originating from unexpected domains or patterns that deviate from standard user activity.

Compensating Controls: Implement a strict Content Security Policy (CSP) and ensure that CORS headers are explicitly defined to allow only trusted origins, rather than reflecting the request origin dynamically.

Public Exploit Available: No (exploit_available unknown)

This vulnerability represents a critical failure in cross-origin security controls that can lead to large-scale data compromise. Administrators should prioritize the deployment of the vendor-provided update immediately. If patching is not immediately feasible, restrict access to the affected instance until the configuration can be hardened to prevent unauthorized cross-origin requests.