IDOR and F5

Does F5 block IDOR vulnerability ? i think this is logical authorization flaw which should be fixed from application level as the WAF treat that as normal url . I'm right ? the case is when you change the id in url you can reach other user profile