Erro CORS quando tento uma XMLHttpRequest com JavaScript

Access to XMLHttpRequest at 'http://localhost:8080/getPublicacoes/buscar-mais?posicao=3' from origin 'http://localhost:5050' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: It does not have HTTP ok status.

Tentei a resposta na API:

return new Response($resposta, 200, ['Access-Control-Allow-Origin' => '*']);

Mas não funciona.

Meu código Js puro

btn.addEventListener('click', (event) => { event.preventDefault(); let qntPublicacoes = $$(".publicacao").length;

console.log(qntPublicacoes);

let xhr = new XMLHttpRequest();
xhr.onreadystatechange = function () {

    if (this.readyState == 4 && this.status == 200) {
        let publicacoes = JSON.parse(xhr.responseText);
        let montarPublicacoes = new MontarPublicacoes();
        let arrayPublicacoes = montarPublicacoes.montarPublicacoes(publicacoes);

        arrayPublicacoes.forEach(publicacao => {
            areaPublicacoes.appendChild(publicacao);
        });

    } else {
        console.log("error");
    }
}
xhr.open("GET", "http://localhost:8080/getPublicacoes/buscar-mais?posicao=3");
xhr.setRequestHeader("Authorization", "Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VybmFtZSI6InVzdWFyaW8ifQ.Yytcv05WKMtD5T4-saEgpZxICv7Vhp6uCnfeP_N2Uew");

xhr.send();

})