If it was filed as a security issue, most well-set-up projects with public issue trackers would keep it closed off only to a reporter and internal security audit team.

Perhaps it was never really declassified in the tracker.

You can't access issues that are not assigned to you. I remember reporting a bug via VRP once, and it was marked as duplicated with another id, that I cannot access and see the original report.

Security sensitive issues have restricted visibility.