CVE-2026-82291
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms, submissions, and respondent data, or modify account settings.
Risk Assessment
The risk includes unauthorized data access and potential modification of account settings, which could lead to privacy breaches and data integrity issues.
Recommendation
Upgrade HeyForm to version 3.0.0-rc.8 or later and configure CORS to restrict allowed origins.
Other vulnerabilities in HeyForm
See all- CVE-2026-35198Critical
HeyForm prior to version 3.0.0-rc.7 contains a stored XSS vulnerability in the form builder. A low-privileged team member can inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation.
- CVE-2026-63429High
Vulnerability in HeyForm before version 3.0.0-rc.9: the POST /api/upload endpoint lacks authentication and form-context validation. Any anonymous user can upload a file (up to 10 MB) and receive a public URL.
- CVE-2026-63428Medium
HeyForm before version 3.0.0-rc.9 does not properly validate `hiddenFields` submitted by users. An anonymous user can inject arbitrary key-value pairs, including XSS payloads, which are then forwarded to webhooks.
- CVE-2026-45797Medium
HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the `/api/upload` endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are stored in the static assets directory and served with `Content-Type: image/svg+xml` by Express's serve-static middleware, allowing an attacker to achieve stored cross-site scripting (XSS) on the heyform domain without any authentication. Version 3.0.0-rc.7 contains a patch for the issue.
Original NVD description (English source)
HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms, submissions, and respondent data, or modify account settings.