A flatpak security update has been released for CentOS 7.

CentOS Errata and Bugfix Advisory 2020:0837

Upstream details at :   https://access.redhat.com/errata/RHBA-2020:0837

The following updated files have been uploaded and are currently
syncing to the mirrors: ( sha256sum Filename )

x86_64:
23a7dd7134cad5bfe5d0819658281af9cc0b22c5fd2c52ee74ed650605114957 flatpak-1.0.9-9.el7_7.x86_64.rpm
7879ff67b06e16046fbd7dd9ed4f714d8b0b3e9e908beccd1221a64e2c696d29 flatpak-builder-1.0.0-9.el7_7.x86_64.rpm
125596c0cf243d64062337c6421c4dbea5235fe11df86616244fcfabad2e0447 flatpak-devel-1.0.9-9.el7_7.x86_64.rpm
1fa5932269cf456e1e8db8dba5ca292366cc6fdb5fbb3c513aa7b677b6e1959d flatpak-libs-1.0.9-9.el7_7.x86_64.rpm

Source:
ea5cf59dd83a282978d86856c4817d0db49ec40ef44ab07eb580edba08affa19 flatpak-1.0.9-9.el7_7.src.rpm