CVE-2023-36050: Microsoft Exchange Server Spoofing Vulnerability

According to the CVSS metric, privileges required is low (PR:L). Does the attacker need to be in an authenticated role on the Exchange Server?

Yes, the attacker must be authenticated with LAN-access and have credentials for a valid Exchange user.