In sys-apps/flatpak-1.10.6 there's a security fix for bug 831087.
x86 done
amd64 done
arm64 done all arches done