This is an everyday event not worthy of a CVE.
It sounds like in this case it could be a simple mistake however the following are useful steps you can take or at least consider for any situation where credentials have been discovered.
Contact the affected users if appropriate: The best way to help if this were a case of a public dump of passwords would be sending a single BCC e-mail to each of the people affected letting them know their credentials have been disclosed and that they should quickly change all of their passwords and potentially look for evidence of abuse of these credentials. Don't copy the information or redistribute it, simply send a link to where it was publicly exposed at or tell them the site name.
Contact the owner and service provider abuse accounts: Likewise if you know how the information came to be disclosed/lost it would definitely be helpful to contact the organization(s) involved that lost the information so they can handle it appropriately. To do this simply send an e-mail to abuse@company.com and optionally a sales@company.com or other publicized contact address.
Do not sign any NDA's in this process. Some companies use NDA's to prevent disclosure it's an ugly issue just don't do it. State that you are only notifying them of the problem and do not want to be involved.
Contacting the affected users is very helpful simply because some organizations when contacted about the loss of such data literally do nothing and never tell the affected users (depending on what country it's hosted in this may not be breaking any local laws either). At least this gives the users a chance to protect themselves from further harm.
Be aware some password dumps are fake: The following doesn't apply to your specific situation but be aware that sometimes people post fake "password dumps" to sites like pastebin.com. So use appropriate language when writing your e-mails "It appears that something may have happened ...". etc...
Assuming this wasn't accidental you can politely request the information be removed but in the case of a password dump if it was made public elsewhere the user may have no obligation to remove it (not your situation I just mention this for others). Again passwords being dumped on-line is a common occurrence and there are many sites hosting millions of exposed passwords from compromised sites.
