Currently CORS is not enabled by default in generated jBPM Business Applications.
Third party apps or extensions etc are not able to issue http requests to a running instance of a business app because of this .