Apache Helix REST contains a CORS filtering flaw that unconditionally returns Access‑Control‑Allow‑Origin: * together with Access‑Control‑Allow‑Credentials: true and echoes request‑specific headers in every preflight response. This permissive policy, classified as CWE‑1385, allows a malicious web page controlled by an attacker to pose as the legitimate user’s browser and issue cross‑origin requests to administrative REST endpoints, reading configuration data or performing management operations that should be restricted to authenticated administrators.

All installations of Apache Helix REST 2.0.0 and earlier, irrespective of operating system or deployment model, are affected. The issue is present in any instance where the default helix‑rest server is used. Upgrading to version 2.0.1 applies a corrected CORS filter that restricts the Allow‑Origin and removes the Allow‑Credentials header for administrative paths.

The vulnerability carries a CVSS score of 7.5 and an EPSS score below 1%, indicating moderate impact but a low likelihood of exploitation today. It is not currently listed in CISA’s KEV catalog. Exploitation requires an attacker to convince an authenticated user to visit a malicious site, after which cross‑origin requests from the victim’s browser can read or alter responses from protected endpoints without needing direct authentication or authorization bypass.