Well, the company has a bug bounty program and you must abide by their rules. Or they do not have a program (and did not give you permission) and your action could fall under the Computer Misuse Act (CMA) in the UK (criminal offense). Also I am not a lawyer, so if you want to public disclose, make sure to talk to some UK lawyers.