Possible security issues of setting Access-Control-Allow-Origin
CORS headers are typically used for JavaScript AJAX request. Browsers have a built-in safety mechanism that doesn't allow you to query other domains unless they explicitly allow it by setting these CORS headers.
There isn't much of a security risk really. You can always send malicious requests anyway. Browsers just collectively decide to play nice.
One thing to be aware of is that you don't necessarily always want to send the
Access-Control-Allow-Origin: http://www.example.comheader. This could potentially lead people to all the domains that make use of your API. My recommendation is that you only emit the header if it is necessary, ie. you get an OPTIONS request from a whitelisted domain.
I wrote a blog post about this recently: http://fritsvancampen.wordpress.com/2013/02/03/cross-site-origin-requests-aka-cross-origin-resource-sharing/