Recently, a colour image encryption algorithm based on chaos was proposed by cascading two position permutation operations and one substitution operation, which are all determined by some pseudo-random number sequences generated by iterating the Logistic map. This paper evaluates the security level of the encryption algorithm and finds that the position permutation-only part and the substitution part can be separately broken with only $\lceil (\log_2(3MN))/8 \rceil$ and 2 chosen plain-images, respectively, where $MN$ is the size of the plain-image. Concise theoretical analyses are provided to support the chosen-plaintext attack, which are verified by experimental results also.