It is “just” that, but: How are numbers assigned? How can others find details? Who determines when these details are public? (note: full CVE details can be used to exploit critical software) If they’re not always public, who gets to see them? And who handles that dissemination? Who takes care of duplicates?

Lots of work does go into this, even if it’s “just” an identifier.