I am also facing the same issue.
I am running NodeBB v1.13.x and whenever I am trying to hit http://localhost:4567/admin/manage/privileges, Access Denied(403) message is coming. I am using bearer token for authorization. Please let me know if anyone know the solution.
@scottalanmiller is correct, those numbers are produced on the fly based on active websocket sessions, and not stored anywhere.
However, you might be interested in https://github.com/barisusakli/nodebb-plugin-browsing-users, which brings a live-list of current users in-topic back to topic.tpl