if TFS is installed using HTTP but only accessible from inside a LAN with Windows authentication, is it possible that a user impersonate someone else? what are other risks?
It depends on how secure your LAN is. If you have full protections against man-in-the-middle attacks (e.g. protection against ARP, DNS or DHCP spoofing), against passive network-wide sniffing (mirror port switch) and also sniffing on local machine then it might be sufficient, i.e. at least not less secure then with HTTPS. If not impersonation might be possible.
Short answer, Yes that is possible.
Long answer, This is also possible without HTTP, (like with HTTPS) but when your TFS-server is running on a machine that can only contact the internal network.
And the network is secured as @steffen-ullrich suggest. Than only the determined attacker can impersonate another.
The thing you have to ask yourself is "when is there enough protection for me", or "When are the risks of a compromise low enough so I can live with it."
Often they wat companies protect themselves against these type of threats is to employ IDS and other network monitoring techniques. That way they known when someone is trying to fool the system and can take action when it happens.