A vulnerability analyst is scoring a newly disclosed flaw in an internal web application. Exploitation requires the attacker to first authenticate to the application using a standard, non-administrative user account before triggering the vulnerable function. Which CVSS base metric value most accurately reflects this condition?