You need both the actus reus and the mens rea, the act and the mental component. Criminal law is very much rooted in intent as well as the act. It's how conspiracy charges are leveraged, you can intend to do bad shit, fuck it up, and still be liable to criminal charges despite the fact you're an awful criminal. Conversely, you can do something that in and of itself might be illegal, but for altruistic means wouldn't be suitable for conviction.

That said, either way you'd wind up having to make your case in court.

The Computer Misuse Act makes mention of unauthorized acts, if a company has a Bug Bounty program, you have a certain level of authorization usually stipulated in the program itself.

Noticing you have access to something you shouldn't and reporting it - Fine.
Exploiting the access for gain, informing unrelated 3rd parties, selling that information outside of the realm of the bounty program - Probably not fine.