diff --git a/src/controller/cve-id.controller/cve-id.controller.js b/src/controller/cve-id.controller/cve-id.controller.js
index ba93ea02f..e33b86411 100644
--- a/src/controller/cve-id.controller/cve-id.controller.js
+++ b/src/controller/cve-id.controller/cve-id.controller.js
@@ -39,8 +39,9 @@ async function getFilteredCveId (req, res, next) {
     const requesterOrgUUID = await authContext.getRequesterOrgUUID(req, orgRepo)
 
     // Create map of orgUUID to shortnames and users to simplify aggregation later
-    const orgs = await orgRepo.getAllOrgs()
-    const users = await userRepo.getAllUsers()
+    // Only project the fields needed for the maps to avoid fetching full documents
+    const orgs = await orgRepo.getAllOrgs({}, { UUID: 1, short_name: 1, _id: 0 })
+    const users = await userRepo.getAllUsers({}, { UUID: 1, username: 1, org_UUID: 1, _id: 0 })
 
     const orgMap = {}
     const userMap = {}
diff --git a/src/repositories/orgRepository.js b/src/repositories/orgRepository.js
index 3eb5d7684..48f47ee93 100644
--- a/src/repositories/orgRepository.js
+++ b/src/repositories/orgRepository.js
@@ -47,8 +47,8 @@ class OrgRepository extends BaseRepository {
     return utils.isBulkDownload(shortName)
   }
 
-  async getAllOrgs () {
-    return this.collection.find()
+  async getAllOrgs (options = {}, projection = {}) {
+    return this.collection.find({}, projection, options)
   }
 
   async deleteOneByShortName (shortName, options = {}) {
diff --git a/src/repositories/userRepository.js b/src/repositories/userRepository.js
index fd04eeb6f..346710878 100644
--- a/src/repositories/userRepository.js
+++ b/src/repositories/userRepository.js
@@ -61,8 +61,8 @@ class UserRepository extends BaseRepository {
     return this.collection.findOneAndUpdate(filter, updatePayload, options)
   }
 
-  async getAllUsers () {
-    return this.collection.find()
+  async getAllUsers (options = {}, projection = {}) {
+    return this.collection.find({}, projection, options)
   }
 }
 
diff --git a/test/unit-tests/cve-id/cveIdGetAllTest.js b/test/unit-tests/cve-id/cveIdGetAllTest.js
index e30098a7f..2946f871c 100644
--- a/test/unit-tests/cve-id/cveIdGetAllTest.js
+++ b/test/unit-tests/cve-id/cveIdGetAllTest.js
@@ -143,6 +143,12 @@ describe('Testing getFilteredCveId function', () => {
     expect(cveIdRepo.aggregatePaginate.args[0][0][0].$match).to.deep.equal(builtQuery)
   })
 
+  it('Should request only the fields needed to build the org and user maps', async () => {
+    await cveIdController.CVEID_GET_FILTER(req, res, next)
+    expect(orgRepo.getAllOrgs.calledOnceWith({}, { UUID: 1, short_name: 1, _id: 0 })).to.equal(true)
+    expect(userRepo.getAllUsers.calledOnceWith({}, { UUID: 1, username: 1, org_UUID: 1, _id: 0 })).to.equal(true)
+  })
+
   it('Should swap UUIDs for names in Cve-ids', async () => {
     await cveIdController.CVEID_GET_FILTER(req, res, next)
     expect(res.status.args[0][0]).to.equal(200)