Mail arrives, but the remote address book stays out of date? Thunderbird 159 fixes two CardDAV problems: synchronization stopping after a rejected sync token and passwords not being saved. This guide helps desktop users and support teams narrow down the case without deleting contacts or accounts. [1]
What the fixes cover
The Thunderbird 159.0 release notes dated October 27, 2026 list the two defects separately. A sync token is an internal synchronization marker, not a password the user should enter. CardDAV handles contacts; CalDAV handles calendars. The separately listed Graph and calendar fixes do not establish the cause of a CardDAV failure. A password prompt alone does not prove this defect. [1]
Requirements and backup
You need access to the affected address book, its approved provider address and a protected backup. Record the operating system, Thunderbird version, installation route, time and affected books. Open the profile folder through Help → Troubleshooting Information, fully quit Thunderbird and copy the profile to a separate protected location. It also contains sensitive account data. The Export tool supports ZIP backups only up to 2 GB; larger profiles require a manual copy. A local copy does not automatically back up the remote server. [2] [3]
Five safe checks
- In Address Book, verify that you selected the remote CardDAV book, not a local book or combined view. Compare two known contacts with the provider's web interface if available: the name and one expected field are enough. Keep confidential data out of screenshots and tickets. If contacts are missing there too, resolve provider-side access or data issues first.
- Separate the symptoms: are only contacts affected, does a previously working book stop updating, or does authentication return after every restart? Record calendar and mail issues separately. For network, certificate or provider errors, do not disable security checks or repeatedly try passwords. The two manufacturer fixes do not cover every such cause. [1]
- Use the approved update route for your installation. With a direct installation, Help → About Thunderbird may already start checking and downloading automatically, so back up first. Update Linux distribution packages through package management. Do not independently move managed or ESR installations to the Release channel. The confirmed fix here is Release 159.0, not a blanket ESR claim. After the required restart, check the version actually running. [1] [4]
- Reopen the affected address book and allow its normal synchronization while the provider is reachable. Compare the same known contacts. If legitimate authentication is necessary, use only the familiar provider route. Do not reveal, copy or share a password for diagnosis. Do not erase all saved credentials or preemptively remove the account or address book.
- Quit and restart Thunderbird normally once more. Check whether contacts remain current and whether the unexpected password prompt returns. Record the actual result and version. If the problem persists, give support only a sanitized error, time and provider; never a profile copy, tokens or full contact lists.
Acceptance and recovery
Acceptance requires known server contacts to appear with the expected fields and remain available after restarting. An equal contact count alone is insufficient; receiving mail does not test CardDAV. This read-only comparison also does not prove write synchronization. Stop further changes if contacts go missing or duplicate. To restore a profile, close Thunderbird and follow the documented import/profile procedure; first preserve the current state separately. Restoring a local profile does not undo changes already synchronized to the server. Do not use a downgrade as a quick fix. [2] [3]
Date and limitations
As of October 30, 2026. Source-based guidance, not our own hands-on Thunderbird test or a guarantee for every provider, add-on or Android/iOS. No Bugzilla ticket was securely matched to the two release entries, so no issue number is invented. The topic reflects manufacturer news, not an asserted CardDAV search boom. No affiliate links.