In the time of the Thunderbird version 60 release cycle.  Actually commencing with the Version 58 beta and Version 60 release.  Thunderbird implemented a migration of password storage and encryption to a new file name and system.  This migration continued into the Version 68 release cycle, but code to clean up the migration was not introduced until Version 68.5 and was removed in the version 72 beta,   so this process needs the profile to go through the Version 68.5 to get the migration to the new formats and the cleanup.

Those who have directly update since then from a version prior to V58 to a version after71 will simply not get the conversion run on their profile.  This means that in some cases the relevant file simply do not exist or that the appropriate cleanup has not occurred, leaving the password storage in an unstable and generally corrupted state.

Anecdotal evidence indicates that everything works as far as reading passwords that are already in the store, but attempt to save changes simply fail.  It is generally accepted that anyone updating from a version prior to 68 to a version after 68 without installing 68 will have issues. If you have a master password you must further enter it in V68 and allow it to get mail in V68 for the update code to run.

 To fix this after the fact open the profile folder as with thunderbird closed and delete the following files if they exist.

  • cert8.db - obselete file
  • key3.db - obselete file
  • pkcs11.txt
  • secmod.db - obselete file
  • session.json
  • xulstore.json

 

Bug reference https://bugzilla.mozilla.org/show_bug.cgi?id=1616495