From geoserver documentation:

Note: id is one of a few reserved keywords in ECQL and thus an attribute (or database column) named id must be quoted, e.g. “id”

So use: CQL="id" IN (1,2,3)