The full name is cross-origin resource sharing, which you can forget once you get the idea. CORS is a browser safety rule: when frontend code at one address tries to read a response from an API at another, the browser checks whether that server said your website is allowed. It’s mainly a browser rule, so the same API can work fine from a terminal command and still fail from your page.
Picture a private event with a guest list. Someone walks up with an invitation from another company, and the host checks whether that company is allowed in before letting them through. This is that guest-list check inside your browser, asking whether this website may read this response from here.
Why you care
CORS is one of the first confusing errors people hit with AI-generated code. The AI writes frontend code that calls an API directly from the browser, it looks reasonable, then the browser blocks it. You didn’t break anything. Figure out where the request comes from, what the server allows, and whether the call belongs in the frontend or should go through your backend instead.