Read the docs
TI-2026-56756 Aliases CVE-2026-82291GHSA-69g7-vm8m-997r

HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials

Priority HIGH 70CWE-942Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms, submissions, and respondent data, or modify account settings.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00553 46th percentileScored 2026-11-07
Fix Fixed heyform (heyform): 3.0.0-rc.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
heyformheyformbefore 3.0.0-rc.83.0.0-rc.8Patch availableCNA
  • heyform Vendorheyform Affected before 3.0.0-rc.8 Fixed in 3.0.0-rc.8 Patch available CNA

Remediation

  • Fix · CNA heyform (heyform) Fixed in 3.0.0-rc.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-82291
  2. 2026-10-03 Alias added: GHSA-69g7-vm8m-997r

References

Patch 1

Advisory 1

Other 2

  • TI-2026-45208 HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no auth/session/form context CVSS 3.1HIGH 8.6
  • TI-2026-27351 HeyForm vulnerable to stored XSS via form field titles CVSS 3.1CRITICAL 9.0
  • TI-2026-45207 Improper input validation in heyform CVSS 3.1MEDIUM 5.8
  • TI-2026-33532 HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload CVSS 4.0MEDIUM 6.4
  • TI-2026-85482 Stored cross-site scripting in HeyForm via uploaded HTML files CVSS 3.1HIGH 7.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences