Please use the code button (</>) when pasting in configuration files. That prevents the special characters in the file from being treated as markdown formatting.
What makes you think that CORS isn't enabled?
You've not shown anything to indicate one way or another whether CORS is working.
If you're looking for CORS headers coming back from ES, then check that you are actually initiating a CORS response - see this topic Config cors setting not working?