I agree with TheJulyPlot that security issues should be brought to the IRT/CSIRT/SOC/CERT team responsible for the website security. A small school might not have any dedicated position, while a university most certainly do.
The goal is that these people is both (a) technically competent to understand what you are reporting and (b) aware that you are actually helping them, while being able to route it to a more accurate recipient if needed (eg. the actual fault might need to be fixed by a separate development team).
If you do not know which is the team handling security issues on your institution or how to contact them, you can go up one level: Contact the National CERT or -for a university- a CERT for the Research network it belongs to.
For example, depending on where you (and the entity) are based on, you could notify in the US the US-CERT, on UK JANET CSIRT, on Spain INCIBE-CERT, on Kazakhstan the KazAcad CSIRT...
There is not a complete guide of teams, but generally you can look up the most relevant CSIRT for your case on FIRST or -for European CERTs- Trusted Introducer.
Please note that there each one will have its own constituency. A national CERT for your country may handle the report redirecting it to the University if needed, but the CSIRT for a private company completely unrelated might discard it.
On (almost?) every case, it is possible to send a report of the incident by email (if you don't find one listed, look for their RFC 2350 section). Which means, for a basic level of anonymity, you can just create a new freemail account and use that to send your incident report. In fact, you could even skip the creation of a new email and send from your usual email address (you may also mention on the report that you prefer not to stay anonymous). If you didn't commit any crime, it is unlikely that anyone would care who you really are. Rather than "send and forget", I recommend you to check that email (ask them for an update if needed). You may simple be thanked and let know that they will handle it from now on, but they might also request more information from you, or ask you to send it to a different team.
I also recommend you to report it as soon as you can after discovery in order to minimize the potential to backfire. Misguided people might assume that whatever you discovered, you will have abused it and are an evil hacker, no matter how silly it could be to the actual vulnerability. However, by taking promptly action to have that fixed (and actually not having abused it!). There are probably some logs that could be checked. If they find out that you tested the vulnerability (even if it takes them months to find on their own), that you did it 1 hour ago before they got a report emails paints a quite different image than realizing that you discovered it 6 months ago. Even if your communication for some reason didn't reach them (suppose for instance that their abuse mailbox were full!), the record itself on the email provider (ie. the Sent mail) disclosing the vulnerability shall be helpful, should you need it.