CVE-2021-35327 is pre-auth or post?

lupulabs

the question is in the title. The endpoint cgi-bin/cstecgi.cgi requires auth?