Allowing for and/or utilizing CVE structure/features is understandable. Requiring a CVE ID (either real or faux -- which would lead to fun collisions down the road) is just a mess and should be avoided at all costs.
Look, I get it: CVE is the standard nomenclature for vulns, flawed as it is. If you do vulnerability management, you need to have that in your tooling. But to REQUIRE a CVE, even for custom-imported e.g. first-party flaws... don't. Just don't. There're public vulns w/o them