When a CMIS call throws an internal exception, it is turned into some kind of HTTP status depending on the binding used, but because of this the transaction is not properly rolled back.
Fortunately CMIS calls are internally checked before execution in most cases so this rarely has an impact.