You are ethically obliged to report it, but for your own protection you should do it anonymously.
There are some companies which welcome people for pointing out security mistakesflaws in their products. Some even have public bug bounty programs where they financially reward people for doing so.
But unfortunately not all companies have that stance.
There are also companies, usually lead by less tech-savy managers, who have a completely different mindset. They believe that when they get hacked, it's not their own fault, it's the hackers fault. So they shoot the messenger. There are incidents of companies prosecuting white-hat hackers and even their own employees for computer sabotage and espionage, even when they didn't do any damage whatsoever and only had the best intentions.
To be save from such a shoot-the-messenger mentalityprosecution, make sure that you:
- Report the problem anonymously
- Do not be condescending
- Point out that you didn't do any damage
- Point out that you didn't expose the vulnerability to a 3rd party and that you do not intend to do so.
- Try not to sound too alarmist, so your message can not be mistaken for a threat or extortion attempt.