The permission to create a workspace generally comes from theorg_member role. If a user does not have create workspace permissions, but can use a template (such as a site wide template admin), then they can hit this error.

The error is a 404 because we generally translate unauthorized errors into 404 by default on the backend.

The error message should be more descriptive and explain the situation.