CVE-2026-82291

High

Description

HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms, submissions, and respondent data, or modify account settings.

SeverityHigh

CVSS8.1

Exploit probability—

ProductHeyform

PublishedAug 28, 2026

First seenAug 28, 2026

Weakness typeCWE-942CWE-942

How to fix

Update

heyform heyform3.0.0-rc.8 or later

Patches

github.com/heyform/heyform/commit/bf9d738ca70ae5641c0c7372982b00365c5144d4

Vendor advisories

github.com/heyform/heyform/security/advisories/GHSA-fg7j-rmgr-rc9g

Affected products

Product	Affected versions	Fixed in
heyform heyform	v < 3.0.0-rc.8	3.0.0-rc.8

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.